Billing Add Credits

Add prepaid credits to a target user (admin only).

H-15 (Security Audit 2026-05-27, OWNER-ratified 2026-05-28 wave-19): the prior implementation passed user["id"] (the admin's own ID) to add_credits, meaning admins could only credit themselves. This forced workarounds via direct DB manipulation that bypassed the per-request + daily caps and left no audit trail. Now requires target_user_id in the request body, validates it exists in users, blocks admin self-credit (anti-self-dealing), and emits structured audit logs BEFORE + AFTER the credit grant so the trail survives even when the underlying call raises.