Enforce consume-once authority before payment submission

Consume each MandateShield decision once, reject a second permit redemption, and preserve provider idempotency as a separate requirement.