Create a charge

Create a durable charge attempt from opaque card and security-code references. `Idempotency-Key` is required so charge admission can be replayed safely. The requested Nedarim terminal must be present in the authenticated application's operator-managed terminal allowlist; an unbound terminal is rejected before charge admission. The idempotency record stores a fingerprint of validated non-sensitive charge fields and the sanitized HTTP result, not the request body, card digits, or security code. A charge can be attempted only while the Session remains connected. After disconnect, the call-scoped card and security-code references are no longer usable. The Gateway stores only safe metadata and never receives card digits, a security code, provider credentials, or raw provider details. A provider timeout or uncertain submission is terminally reported as `indeterminate` and is never automatically submitted again. See [Payment lifecycle events](/api/payments#lifecycle-events) for complete payload schemas and examples.