Open the payment provider's page for adding a card. The card number is typed there and never reaches the API. The customer comes back to `returnPath` on the website with `setup_session` in the query (and `default=true` when `default` was asked for); send those to `confirm`. With a test key there is no card page and no real card: the returned URL only carries the setup's id in its `session` parameter; finish the setup with `POST /v1/payment-method/test-setup`, then `confirm` it. Needs the permission to manage payment methods. In live mode, 409 `live_unavailable` until live full-service cases are switched on; 503 `payments_unavailable` when online payment is off