feat: add user decrease-only update credit

[amandazhuyilan]

Pull Request

Summary

SBP-399: add new route to update user credit.

Changes

• New self-service route PUT /api/users/me/credit - Authenticated user only (via get_current_user_id`) — no admin gating.
  • Body { credit: int } (ge=0); sets credit_updated_at + credit_updated_by (the user's own email).
  • Decrease-only guard: if the requested balance is higher than the current one → 403 "Credits can only be decreased". This is the key safety measure — without it, a self-service absolute-set would let users grant themselves unlimited credits.

How to Test

CI shall pass!

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have added tests that prove my fix is effective or that my feature works
• I have added or updated documentation where necessary
• I have run linting and unit tests locally
• The code follows the project's style guidelines