Create a single punch record. Fully idempotent when an idempotency_key is provided (either in the body or the Idempotency-Key header). On duplicate key detection, returns the original punch with action: "duplicate" instead of an error.

Validates that the employee belongs to the API key's account and has an active employment record. Timestamps are stored as-is (timestamptz) — the caller is responsible for providing absolute timestamps.

Required scope: write:punches