Open the payment provider's page for saving a card. The card number is typed there and never reaches the API. The customer comes back to `returnPath` on the website with `setup_session` in the query; send that to `confirm`. With a test key there is no card page and no real card: the returned URL only carries the setup's id in its `session` parameter; finish the setup with `POST /v1/payment-method/test-setup`, then `confirm` it. In live mode, 409 `live_unavailable` until live full-service cases are switched on (the full service is offered only in test mode for now). 503 `payments_unavailable` when online payment is off