Disable automatic top-ups when removing a saved card
Removing the selected saved card currently leaves automatic top-ups enabled. With another tagged Stripe customer, a subsequent low-balance deduction can charge that other card. This change persists auto_topup_enabled: false on the authorized account before detaching the selected card.
If saving the setting fails, removal returns a masked 500 before detachment. If Stripe then fails, top-ups remain off and removal returns 500. Existing 404 and empty 204 responses remain. Amounts, thresholds, balances, other cards, subscription/invoice code and manual purchases are unchanged. Already-in-progress charges and concurrent explicit re-enablement are outside this fix.
Validation: Records' independently authored nine-case provider-boundary acceptance suite is reused from #1053; all nine now pass, including the multi-customer fallback and settings-write failure cases. All 488 billing/credits/Stripe tests (105 files), full ESLint, scoped formatting and whitespace checks pass. Six additional focused regressions cover ordering, absent credits rows and partial failures; four failed before the fix. Repository TypeScript currently reports diagnostics outside the changed files; no changed-file diagnostics were reported. All providers are mocked; no real billing or customer operations occurred.
Tracks recoupable/mono#343; deliberately does not close it. Account-wide card: null / checkout-only semantics and public error schema alignment still require a separate contract decision. Concrete policy options and failure/concurrency limits are documented in docs/verification/card-removal-acceptance.md. Supersedes the test-only draft #1053 for delivering those tests with a passing implementation. #1009 changes credit writers and has no overlapping files.
Independent repair review and qualifying merge remain with the coordinator.
Summary by cubic
Fixes a bug where removing the selected saved card left automatic top-ups enabled, letting a later low-balance deduction charge a different card on another tagged Stripe customer.
DELETE now persists auto_topup_enabled: false on the authorized account before detaching the card. If the settings write fails, removal returns a masked 500 without detaching; if Stripe then fails, top-ups stay off. Empty 204 success and 404 no-card/customer responses are unchanged. Amounts, thresholds, balances, other cards, and subscription/invoice or manual purchase paths are unaffected.
Validation
- Reuses the independently authored nine-case acceptance suite from #1053; all nine now pass, including the multi-customer fallback and settings-write failure cases.
- Adds six focused regressions covering ordering, absent credits rows, and partial failures; four failed before the fix.