POST /api/v1/payment-intents — request validation.

Scope enforcement (payments:write) handled upstream by EnforceApiScope. Tenant isolation: booking_id is decoded + looked up under BelongsToTenant, so a cross-tenant booking reference resolves to 404 in the controller.

amount_minor is OPTIONAL — when omitted, the controller derives the amount from the booking total. Pass it explicitly only for partial-pay / deposit flows where the charged amount diverges from booking.total_price.