Start saving a card

Runs user.createSetupIntent. Returns { clientSecret } for a Stripe SetupIntent on the user's Stripe customer (created on first use). Confirm it with the Stripe SDK — the card number never touches our servers — then send the resulting pm_ id to POST /v1/payment-methods. Redirect-based methods are excluded, so no return URL is needed. Takes no input, so this route accepts no request body.