Idempotency key is sent in the JSON payload

[saxon134]

VideosResource.create and TasksResource.create pass all keyword params through _payload(request, params) while also deriving the Idempotency-Key header from params.get("idempotency_key"). With the main src package on PYTHONPATH, client.tasks.create(type="image_generation", idempotency_key="idem_1") sends both header Idempotency-Key: idem_1 and JSON body {"type":"image_generation","idempotency_key":"idem_1"}. If the API treats idempotency as a header-only control field, strict request validation can reject the request or persist the control field as task input. Exclude idempotency_key from the serialized payload before calling _payload for sync and async create methods.

File: src/globalrouter/_resources.py

Line: 335

Severity: medium

Summary: idempotency key serialized in create payloads

[saxon134]

Coding Loop Plan

Refined Issue

Bug: when callers pass idempotency_key to resource creation methods, the SDK should send it only as the Idempotency-Key HTTP header and must not include idempotency_key in the JSON request body.

Implementation Plan

Fix idempotency handling for both sync and async video/task creation methods. Build the JSON payload without the SDK-only idempotency_key parameter, while continuing to send its value as the Idempotency-Key header. Keep all other request body fields unchanged and leave unrelated endpoints untouched.

Add focused regression tests using httpx.MockTransport for videos and tasks that capture outbound requests and assert that idempotency_key is absent from the JSON body while Idempotency-Key is present in headers. Include coverage for the async creation methods as well, since they have separate request-construction code paths.

Development Tasks

1. Keep idempotency_key out of JSON payloads
   Update VideosResource.create, VideosResource.create_async, TasksResource.create, and TasksResource.create_async so idempotency_key is consumed as a request option, not serialized into json_body. Preserve existing behavior where a non-None key is sent as the Idempotency-Key header. Prefer a small local helper in src/globalrouter/_resources.py, such as a payload helper that omits idempotency_key, rather than changing BaseResource._payload globally because other resources may legitimately pass arbitrary JSON fields.
   Files: src/globalrouter/_resources.py
   Tests: python -m pytest tests/test_client.py -q

2. Add regression tests for header-only idempotency
   Add focused tests in tests/test_client.py using httpx.MockTransport for both /api/v1/videos and /v1/tasks. Each test should call the corresponding create method with idempotency_key="idem_1", assert the outgoing request header contains idempotency-key: idem_1, and assert json.loads(request.content) does not contain idempotency_key. Include async coverage if following the existing async test style is straightforward; otherwise make the sync regression cover both affected resources.
   Files: tests/test_client.py, src/globalrouter/_resources.py
   Tests: python -m pytest tests/test_client.py -q, python -m pytest tests/test_client.py::test_openrouter_surface_headers_and_resources tests/test_client.py::test_native_surface_and_sse_streaming -q