Replay guard landed: lightweight inbound dedupe is now on main

[happysnaker]

A small but real production-minded improvement just landed on main:

• lightweight inbound replay dedupe now runs before command handling / ACP dispatch
• repeated OneBot events can be dropped before they become duplicate ACP calls
• a new Prometheus metric qq_ai_bot_inbound_duplicates_total is exposed
• config knobs now exist for the dedupe window and cache size

Why this matters:

This repo should keep feeling more like message infrastructure than a happy-path bot demo. Replay / duplicate-delivery edges are one of the first operational annoyances once the bridge sits in front of a slower or side-effectful agent runtime.

The next high-signal follow-up is now issue #13:

• enhancement: add per-interaction correlation IDs across receive, dedupe, progress, and reply

If you want one code contribution direction that still feels small but non-trivial, #13 is the best next hook.