Cardholder-data paths mapped to PCI requirements.

@app.post("/payments/save-card")
def save_card(card: CardIn, user = Depends(auth)):
    token = pci_gateway.tokenize(
        card.number,    # never logged, never stored
        tls_min="1.2",
    )
    db.execute(
        "INSERT INTO payment_tokens "
        "(user_id, token, last4, brand) "
        "VALUES (?, ?, ?, ?)",
        (user.id, token, card.last4, card.brand),
    )
    audit.log("card.saved", user=user.id, last4=card.last4)

✓ Only the token and last four digits hit the database. Req 3.4, 3.5, and 4.2 satisfied on the first prompt.