enableAccount reads a body (json.DecodeBytes -> twoStageEnableReq) only when the
org enables two-stage signup; all fields optional. Modeled as an optional
requestBody { password, passwordConfirm } with additionalProperties (embeds
user.User). The six money/order actions (createAccessToken, order capture,
cart discard, checkout capture/confirm/cancel) read NO body and stay body-less
by design (captured amount is the stored order amount, never client-supplied).
zeekay
1ec50a0604