fix(hooks): store a hook delivered twice only once

A doubled hook registration (plugin + leftover checkout install) POSTs every
event twice with a byte-identical payload, so the timeline showed each row
twice and token/alert/lane side effects ran twice. POST /api/hooks/event now
skips a payload identical to the session's LATEST event from the last 10s
(findRecentDuplicateEvent). Latest-only keeps two legitimately identical
Stop events of consecutive turns, which always have other events between.

server/db.js

@@ -1476,6 +1476,17 @@ const stmts = {
        AND updated_at < strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-' || ? || ' minutes')`
   ),
 
+  // A second delivery of one hook: the session's LATEST event, a few seconds
+  // old, with the same type and a byte-identical payload (the duplicate guard
+  // in routes/hooks.js). Latest only, never "any recent": two turns can end in
+  // identical Stop payloads, but real work always lands between them, while a
+  // double delivery arrives back to back.
+  findRecentDuplicateEvent: db.prepare(
+    `SELECT 1 FROM (SELECT event_type, data, created_at FROM events
+       WHERE session_id = ? ORDER BY id DESC LIMIT 1)
+     WHERE event_type = ? AND data = ?
+       AND created_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-10 seconds')`
+  ),
   insertEvent: db.prepare(
     "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))"
   ),