Confirm a physical application idempotently; charge fees and reserve inventory for admin review

Permission: card.physical.create. Body: applicationId and merchant callId. Charges quoted fees and reserves stock for review, without bank binding. Retry the same pair after uncertain responses; query /cards/physical/application first. Never reuse the callId for another quote. Next: wait for review/shipment and track application updates. Rejection refunds fees; a returned cardId is not an active/bound card.