Mirror Square's customer_id requirement in the dev mock card-creation gate

Square rejects POST /v2/cards without card.customer_id at runtime (confirmed by Square's SDK maintainer); the production client omits an empty id via omitempty and every caller provisions a customer first, so the mock now enforces the same structured 400 INVALID_REQUEST_ERROR to keep sandbox/dev parity with the gate the production code depends on.

backend/internal/square/square_dev.go

@@ -457,6 +457,21 @@ func (m *MockClient) CreateCardOnFile(ctx context.Context, userID, cardToken, cu
 		return nil, fmt.Errorf("invalid source_id: %s — use a card nonce (cnon:xxx) or card ID (ccof:xxx)", tokenPrefix(cardToken))
 	}
 
+	// Square's POST /v2/cards rejects a card without card.customer_id at
+	// runtime (confirmed by Square's own SDK maintainer). The production client
+	// omits an empty customer_id via omitempty and every production caller
+	// provisions a Square customer first, so the gate is enforced upstream — the
+	// mock must mirror it (same structured INVALID_REQUEST_ERROR as the ccof:
+	// CreatePayment gate above) so sandbox/dev tests exercise the same rejection.
+	if customerID == "" {
+		return nil, &squareAPIError{
+			Code:       "INVALID_REQUEST_ERROR",
+			Detail:     "customer_id is required to create a card on file",
+			StatusCode: http.StatusBadRequest,
+			err:        errors.New("square: customer_id is required to create a card on file"),
+		}
+	}
+
 	m.mu.Lock()
 	defer m.mu.Unlock()