Update Card

Replace the customer's card with the one a Recurly.js token stands for (Frederick, 2026-10-06, issue #4060). Card number, expiry and security code NEVER arrive here: anything but the token, reason and ids, or any 13 to 19 digit run, is 422 card_data_refused (fixed sentence, nothing repeated). The token is never logged. 409 carries Pigeonly's word (a declined card); 502 outcome_unknown means do not send it again. Body (read raw, so not in the schema): token, an optional reason (the design's Update card asks for none), and optional request_id, ticket_id, call_id, suggestion_id (the suggestion that was on screen, which records whether this act took it) and contact_reason (what the customer contacted us about; both issue #4067).