ChangeTier

Validates POST /v1/billing/plan-change/commit (D-32 + D-42). Body: to_tier_id: required UUID — target paid tier. Headers: Idempotency-Key: required UUIDv7 (D-32). Forwarded to Mollie + stored on the billing_intents row so caller retries collapse server-side. Authorization: Owner-only (D-42). Pivot lookup mirrors {@see PlanChangePreviewRequest}.