Per-customer overage policy

A customer’s overage_policy now decides whether that customer can spend past a zero balance. If the customer has no policy set, the tenant default applies.

This works in both directions. A tenant that allows overage can block one risky account. A tenant that blocks overage can allow one trusted account.

Two smaller changes came with it. On the customer endpoint, an invalid overage_policy is now a 422 that names the field, instead of a database error. Sending an empty string clears a customer’s override, the same way it already works for display_name. Sending null, or leaving the field out, leaves the stored value unchanged.

Nothing changed for existing customers. Every live customer had this field unset, and every tenant defaults to block.