Ing 462

[mariohd]

Stacked on #ING-466 — base this PR on ing-466, not main. It calls BillingObjectConnections::AttachToResourceService, which only exists there, so merging it first would break main.

Context

ING-462. The subscription half of per-object connection routing (dive-in T18b). ING-466 added the write path for wallets plus the shared validation and persistence services; this reuses them unchanged.

Description

POST/PATCH /subscriptions accept a connections object keyed by category, with the same semantics as the wallet endpoints:

"connections": {
  "payment":    { "behavior": "skip" },
  "accounting": { "code": "netsuite_sub2" },
  "crm":        { "behavior": "inherit" }
}

A code pins that connection, skip short-circuits the category so it never falls back, inherit drops the override, and an omitted category changes nothing.

No new services. ING-466's two are polymorphic in the owner, so this PR is only params, one validator method, and two write paths — 261 lines, most of it specs.

Behind the multi_connection flag. Connections sent while the flag is off are refused rather than ignored; an unresolvable code is a 422. The existing top-level payment_method is untouched.

Reviewer note — the downgrade case

Subscriptions::CreateService attaches invoice_custom_section with unless downgrade?. I deliberately did not copy that guard. Connections are routing config in the same family as payment_method, which both PlanUpgradeService and PlanDowngradeService already carry onto the new subscription — so skipping them on a downgrade would silently discard the operator's choice. Upgrades and downgrades are each pinned by a spec.

Testing

12 new examples: 7 request (4 POST, 3 PUT) and 5 service, the latter covering plain create, unresolvable code, flag off, and the upgrade/downgrade behaviour above. Regression: 2001 examples across the subscription request and service suites, plus 156 for the non-REST callers — GraphQL mutations, Orders::SubscriptionCreation::ExecuteService, Orders::SubscriptionAmendment::ExecuteService. All green, Rubocop clean.

[lago-claude-ai-agent]

Automated pre-review (advisory, not a required check) — verdict: HOLD · CI green

HOLD — Two call-context failures can misroute or silently drop requested connection overrides.

• Subscriptions::CreateService attaches downgrade connections to PlanDowngradeService's returned current subscription, not the newly created pending subscription. Attach them to the pending subscription and make the spec assert both owners explicitly.
• Wallets::RecurringTransactionRules::CreateService rescues an AttachToResourceService.call! failure but returns its untouched successful result, so an unresolved nested code can persist the wallet/rule without its requested override. Propagate the failed result so the outer transaction rolls back, and add endpoint coverage for this nested failure.