Admin backfill/retry for immediate mask-linking: matches the subaccount's
ENROLLED cards against its credit bank accounts by mask (an enrolled
card's last 4 digits) and links each exact match. The same
exactly-one-or-skip rules as completion-time linking apply — a mask
matching multiple cards, or multiple accounts claiming a mask, links
nothing (transaction-based discovery remains the backstop). Idempotent:
already-linked pairs are skipped. Intended for onboarding backfills
(cards enrolled before the bank link) and recovery after a transient
directory failure at completion. Emits no webhook — linked cardIds
appear on subsequent bank-account reads.