POST /api/integration/v1/customers — create a customer

D1 fix: The caller does NOT need to supply parentId in the request body — the integration API derives it from the authenticated key's organization. [AllowMissingParentId] removes the [Required]-ParentId model-state error before [ApiController] ModelStateInvalidFilter can short-circuit the request.

E2E-fix: [RequireRole(Member)] was misleading — UnifiedAuthorizationService.CanCreate hard-blocks Member from creating customers (only BillingSubTaskTimeReport allowed for Member). Changed to Manager so the route-level gate matches what CanCreate enforces, giving Member-role callers a clean 403 from [RequireRole] instead of a confusing 422 "Unauthorized" from the data layer.