Normalised by the caller; absent falls back to keylessReplay.
With no key, replay an identical request inside the keyless TTL. The
caller sets it only for an opted-in /v1/ route with a resolved customer.
The matched route template, logged on a replay or a 409. Never the concrete path.
Resolved customer, or the service name for a request carrying no customer.
Replays a request that already succeeded under the same scope and key.
createHttpLambdaHandlercalls this afterresolveCustomerId, so the scope is the resolved customer rather than a second read of the credential headers.