DELETE /v1/customers/{id}/payment-methods/{pmId}

Revokes the card. {pmId} is the Stripe payment_method_id (pm_xxx) — not an internal row id. Card is resolved by (tenant_id, customer_id, mode, stripe_payment_method_id) — all four must match or the call 404s.

Returns 200 with the updated resource (even on idempotent re-revoke) so callers don't need a follow-up GET.