Change where the card may be used

Category and country rules, separate from the amount ceilings. Takes effect on the next authorisation, like the limits, and for the same reason: a rule added now does not reverse a purchase already made. A refusal here is reported as its own decline reason — `category_not_allowed` or `country_not_allowed` — rather than as a limit breach, because the two lead to different actions. Somebody over a limit waits or asks for a raise; somebody blocked by category is holding the wrong card. **A missing value passes.** Not every network sends a category or a country on every authorisation, and refusing on absence would decline ordinary spend for a field the acquirer chose not to populate.

curl -X PUT "https://example.com/api/b/v1/cards/497f6eca-6276-4993-bfeb-53cbbbba6f08/controls" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "label": "string",  "holder_user_id": "0945901a-0f71-46d3-9812-de7afb578bb4",  "currency": "string",  "status": "string",  "last_four": "string",  "expiry": "string",  "per_transaction_minor": 0,  "daily_minor": 0,  "monthly_minor": 0,  "allowed_categories": [    "string"  ],  "blocked_categories": [    "string"  ],  "allowed_countries": [    "string"  ],  "blocked_countries": [    "string"  ],  "frozen_reason": "string",  "created_at": "2019-08-24T14:15:22Z"}