SubmitTierRequest

FormRequest for POST /v1/tier-requests. Whitelist is the explicit input contract for the 3-step Mercury sub- flow at /settings/billing/request-custom. Admin-only columns (`quoted_price_cents`, `quoted_currency`, `quoted_period_months`, `declined_reason`, `reviewer_id`, `set_by_admin_id`, `status`, `provisioned_at`) are NEVER on this list — they are mutated only by the admin-side state-machine commands (Advance / AmendQuote / Decline / Provision). Threat-model T-40-03-D (mass-assignment). `idempotency_key` is a UUID minted client-side (uuidv7 preferred, uuidv4 acceptable fallback) — the database has a UNIQUE index and the handler short-circuits on replay. `size_estimate` is the household size — the Custom-tier discovery heuristic kicks in at >12, so the form-request requires `min:1` (the SPA fork enforces >12 on the discovery side; the API accepts smaller values so an operator-led onboarding via the billing-tab hatch is not blocked).