Update My Tokens

Switch the caller's own extra tokens on or off (jwt). The switch is rule 5's.

Writing only use_extra_tokens: balances are written by charges, and an editable magnitude would break the identity every account holds against its token_charge rows.

Switching it on releases work held on the budgets, so buying and then enabling drains the queue in the same minute rather than a day later — release_quota_holds decides whether the payer is actually funded, so switching it off releases nothing.

One transaction, holding the account row from the write through the release. The earlier split — write, commit, then scan in a second transaction "so the file scan never runs under the account row's lock" — bought a shorter lock with two defects: a failure in the second half answered 500 with the switch already committed, and a concurrent charge could place a hold in the gap that the release then never saw (the release decides on a balance read, so a hold written after that read stays held until the next funding event). The lock is the payer's own row and the scan is bounded by their own held files, so the cost of holding it is a charge to this same payer waiting; the cost of not holding it is a document held for a day.

PayerScopedDep for the reason re-pointing a payer needs its own elevation: a payer is very often not a member of the companies they pay for, so releasing their held documents is refused under their own principal by the tenant scope. The elevation grants no authorization — the row written is the caller's own account, keyed on their user id — and it refuses a support session and a company-scoped key on the way in.