Switch a customer between active and inactive.

An inactive customer can't be attached to a new payment intent. Existing payments are not affected. gateway_locked is set only by the system and returns 403 GATEWAY_LOCKED_SYSTEM_RESERVED; any other invalid value returns 400. A customer of another merchant returns 404.

Merchant users work on their own merchant's customers. Tenant owners and admins can work on any merchant in their tenant by passing ?merchantId=. A merchant in another tenant returns 404. Other roles are refused.

Authenticate with a dashboard session token, or a merchant-pinned secret key in X-API-Key. A secret key acts only for its own merchant: anything it creates belongs to that merchant and records the key as the actor, and another merchant's customers return 404. Publishable, payout_write and agent_onboarding keys are refused.