8. Payment Method Management & Card Tokenization

## Parent PRD

#1

## What to build

Card management interface for customers. Users save credit/debit cards during signup or later via the app. Cards are tokenized with Razorpay (no card details stored locally) and used for all trip payments.

Implements payment method CRUD, default card selection, Razorpay tokenization (mocked for MVP), and frontend card management UI.

## Acceptance criteria

- [ ] `POST /payment-methods/add` accepts card details, returns token (JWT required)
- [ ] Mock Razorpay tokenization: generate fake token like 'razorpay_token_xxx'
- [ ] `GET /payment-methods` lists all saved cards (last 4 digits only) (JWT required)
- [ ] `DELETE /payment-methods/:id` removes saved card (JWT required)
- [ ] `PUT /payment-methods/:id/default` sets card as default (JWT required)
- [ ] Customer must have at least one payment method (enforced at trip end)
- [ ] Database schema: `payment_methods` (id, user_id, razorpay_token, last_four_digits, is_default, created_at)
- [ ] Only user's own payment methods can be retrieved/deleted
- [ ] Frontend: Add card form (card number, expiry, CVV)
- [ ] Frontend: Saved cards list with last 4 digits and expiry
- [ ] Frontend: Set default card button
- [ ] Cards never displayed in full (security)
- [ ] Edge case: delete default card should auto-set another as default or error

## Blocked by

- Blocked by #2 (Authentication - needs user context)

## User stories addressed

- User story 12: Save card during signup