fix(escrow-service): idempotent arbitrate skip, penalize mismatch log, consistent save() return

[RedAvocado22]

Closes #52
Closes #53

#52 — ArbitrateEscrowUseCase / PenalizeEscrowUseCase minor cleanup

• ArbitrateEscrowUseCase: added a skip-guard when status == ARBITRATED, same shape as the existing idempotency guards in ConfirmDepositUseCase/ReleaseEscrowUseCase/PenalizeEscrowUseCase. Previously a retried admin arbitrate request would fall through into EscrowAccount.arbitrate()'s own guard and throw IllegalStateException("This payment not fully locked yet.") — a confusing message for what's actually an idempotent-retry case.
• PenalizeEscrowUseCase: when skipping an already-penalized account, now logs a warn if the incoming event's cancelledBy doesn't match the party that was actually penalized (derived from the stored status), so a data mismatch is visible for debugging instead of silently returning.

#53 — EscrowAccountRepositoryImpl.save() return-value inconsistency

save() returned mapper.toDomain(saved) — a freshly reconstituted object — instead of the account argument it had just mutated (domain events already drained from it). No current caller reuses the pre-save reference, but it's inconsistent with ContractRepositoryImpl.save() (contract-service), which returns the original object, and is a footgun if a future caller holds onto account after calling save(). Now returns account directly.

Test plan

• Full escrow-service test suite passes