Money safety: dry run, confirm, idempotency

Creating a server places an order and pays it from your account balance — never from a stored card.

1. Ask for a quote: "dry_run": true. Nothing is created.
2. Order with "confirm": true and an Idempotency-Key header (a UUID per logical order).
3. Network error? Retry with the same key and body: you get the first answer back (Idempotency-Replayed: true), never a second server.

Destructive actions (rebuild, reset, snapshot restore, delete) also need confirm. One-time root passwords are only returned on requests without an Idempotency-Key, because replayable answers are stored.