feat(stripe): support Lago-owned SPTs

[anassg-lago]

Agents can set billing_configuration.default_shared_payment_token through Lago's customer API and have Lago collect invoices using that token, without relying on Stripe's customer-default-token field.

The token is stored on the Stripe provider-customer connection. An explicitly configured Lago token takes priority over saved cards; rejection does not fall back to a card. Omitting the field preserves it, while explicit null clears it. Customer responses expose has_shared_payment_token instead of the credential. Explicit manual-payment choices remain manual, and token-only customers can be collected automatically.

SPT collection supplies payment_method_data.shared_payment_granted_token, restricts the payment method to card and uses Stripe API version 2026-04-22.preview. The existing feature-flagged Stripe-customer token lookup remains available when no Lago token is configured.

Validation

• Rebased the existing implementation onto current main without conflicts.
• All eight changed Ruby files pass syntax checks in a Ruby 4.0.6 container.
• The seven focused SPT request examples pass in the existing local Lago API container with unrelated ClickHouse migrations disabled. That container runs Ruby 3.4.8 and the equivalent local implementation; this is not an exact-current-main RSpec result.
• The two-container agent/hash integration completed a fresh Stripe test flow: buyer-issued SPT → Lago credit invoice → settled wallet credit → hash usage debit → HTTP 402 at zero balance. Retry and restart checks preserved the same identity and operation results.
• Changed-file secret scan passed; local paths, personal names and sandbox account/invoice identifiers were removed from the documentation.

This is a draft pending current-main CI validation under Ruby 4.0.6. The token uses the existing settings JSON without additional encryption. The patch keeps Lago's existing retry policy and adds no dashboard input, per-invoice token override or automatic token clearing.