Client-supplied `merchant_id` in the body is silently ignored instead of rejected

[Darkdruce]

Summary

Since tenancy comes from auth, a merchant_id field in the request body has no effect and is dropped without error.

Location

• src/api/payments.rs:92-98 (field absent from struct; extra JSON keys ignored)

Details & impact

Integrators (following the current docs) believe they set the merchant; silently ignoring it hides the mistake.

Suggested fix

Either 400 on unexpected fields or explicitly document that body merchant_id is ignored (and remove it from docs).

Acceptance criteria

• Behavior for body merchant_id is explicit and documented.

[ayomideaccess]

I'm familiar with this project. I resolved some issues on this project successfully already