Stripe event: payment_method.attached, a new card is on file and it is not the default yet

# payment_method.attached: validate it, do not assume it is the default

A payment method is now attached to a customer. Nothing else changed.

## What to do on receipt

1. Read `data.object`: type, card brand, last4, expiry. Run your own sanity checks: is it expired already? Is it a prepaid card when your business needs a real one?
2. If this attachment came from your "update payment method" flow during dunning, set it as the default: on the Customer (`invoice_settings.default_payment_method`) or on the Subscription (`default_payment_method`). Attachment alone does not change what gets charged.
3. If you collected it via SetupIntent for future use, confirm the SetupIntent succeeded. An attached method from a failed setup can still appear; check `data.object` was not the result of an incomplete flow.
4. Return 200.

## The trap

Assuming the newly attached method becomes the default. It does not. The customer updates their card during dunning, the next renewal still charges the old dead card, the invoice fails again, and everyone is confused. Setting the default is a separate write; do it in the same flow.

## Checklist

- Detaching the old method after a successful replacement keeps the customer's wallet clean, but only after the new default is confirmed working. Order matters.
- For 3D Secure regions, a card attached without authentication may fail its first off-session charge. Consider requiring authentication at attach time for subscription businesses.