Form-scoped equivalent of POST /v1/merchants/:merchantId/locations. Resolves the merchant from the form record then delegates to LocationApiService: name, address, mcc and phone are required and stored exactly as supplied; a location never inherits the merchant's own values. bankingId, when supplied, must reference a bank account on this merchant (400 otherwise). RETRY SAFETY: send an idempotency-key header, generated once per new location and reused on retry — a retried request after a timeout returns the original 201 with the same location id instead of creating a duplicate. Without the header no replay protection is applied.
400Validation failure, bankingId does not match a bank account on this merchant, or the form has expired ({ expirationUrl }).
404Form or merchant not found.
