Add Stripe Ephemeral Key and Card Status Management Endpoints

New endpoints

• POST /cards/{card_id}/ephemeral-key
  • Returns an ephemeral key secret and provider card ID to be used by the frontend card display SDK. This allows displaying sensitive card details (PAN/CVV) directly in the browser without exposing them to the backend.
• PATCH /cards/{card_id}/status
  • Accepts a JSON body with status set to "active", "inactive", or "canceled".
  • Updates the card status on Stripe, synchronizes the status in the database, and returns the updated ApiCard.

Both endpoints require JWT authentication and validate card ownership by the authenticated borrower.