Let a studio pick its default payment method and disconnect Stripe

Stripe configuration was a one-way door. Keys could be entered but never
removed, and entering them moved every student onto card billing at once,
so there was no way to have Stripe live and satisfy yourself that card
payments worked before committing the studio to them.

Two settings-page changes open both directions:

Default payment method (`us_default_payment_method`) is now an explicit
choice between card and e-transfer for students with no per-student
override, rather than something inferred from whether keys exist. Card
remains the default, so a site that adds keys and changes nothing else
behaves as before. BillingMethodResolver still degrades a card default to
e-transfer while Stripe is unconfigured — there is nothing to charge a
card with — and `comp` is deliberately not offerable studio-wide, since
it would silently stop billing everybody; an unrecognised stored value
reads back as card. Holding the default on e-transfer with Stripe live is
the staged-rollout path: move individual students to card on their detail
page, watch real charges land, then flip the studio over.

Clear Stripe configuration deletes the publishable key, secret key and
webhook signing secret and returns the mode to test, so a re-configuration
later cannot inherit live. Currency, HST, e-transfer and registration
settings are untouched, as are recorded payments. The button only appears
when some Stripe value is stored, and reuses the page's existing nonce and
`manage_billing` check.

`composer test` (915), `composer lint` and `composer cs` all pass. Options
only — no schema change, so no version bump.

Closes #173

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WyktWmwNRgMYuwe5eBuPZm

docs/features/payments.md

@@ -34,6 +34,15 @@ page (`manage_billing`, studio admin only):
 | `us_currency`                | Default ISO 4217 currency, e.g. `CAD`  |
 | `us_etransfer_email`         | Studio-default e-transfer destination  |
 | `us_hst_rate`                | Default HST/tax percentage, e.g. `13`  |
+| `us_default_payment_method`  | Studio-default billing method (`card` \| `etransfer`) |
+
+Secrets are write-only in the form: a stored secret is never echoed back, and a
+blank field keeps it. To disconnect Stripe entirely, **Clear Stripe
+configuration** (shown once any Stripe value is stored) deletes the publishable
+key, secret key and webhook secret and drops the mode back to `test`
+(`StudioSettings::clearStripeConfig()`). Currency, HST, e-transfer and
+registration settings are untouched, as are payments already recorded; billing
+falls back to e-transfer until keys are entered again.
 
 ## HST / Tax
 
@@ -52,8 +61,9 @@ total when tax applies.
 ## Per-Student Billing Method
 Each student's billing method is stored in user meta `us_payment_method`, set by the
 studio admin (`Students → student detail → Billing method`). When unset, the studio
-default applies — `card` if Stripe is configured, otherwise `etransfer`
-(`BillingMethodResolver`):
+default applies (`BillingMethodResolver::defaultMethod()`): the
+`us_default_payment_method` option, degraded to `etransfer` whenever Stripe is not
+configured, since a card cannot be charged without keys.
 
 | Method     | Behaviour                                                              |
 |------------|-----------------------------------------------------------------------|
@@ -61,6 +71,22 @@ default applies — `card` if Stripe is configured, otherwise `etransfer`
 | `etransfer`| Payment row created `pending`; admin marks it `paid` when funds arrive |
 | `comp`     | No charge; registration is confirmed immediately, no payment row required |
 
+## Studio Default Billing Method
+**Studio Settings → Billing → Default payment method** (`manage_billing`) chooses
+between `card` and `etransfer` for every student without an override. Card is the
+default, so a studio that adds Stripe keys and changes nothing else behaves as it
+always has.
+
+Setting it to `etransfer` is the **staged rollout** path: Stripe stays live, but
+the studio keeps billing by e-transfer while individual students are switched to
+`card` on their student detail page. Their bookings exercise real Stripe charges
+end to end; once that is proven, flipping the studio default to `card` moves
+everyone at once and the per-student overrides can be cleared.
+
+`comp` is deliberately not offered as a studio default — it is a per-student
+decision, and a studio-wide `comp` would silently stop billing everybody. A stored
+value that is neither `card` nor `etransfer` reads back as `card`.
+
 ## E-transfer Destination Email
 Where students send e-transfers is resolved and **frozen onto the payment** at
 booking time (`us_payments.etransfer_email`), so each record keeps the destination