Record credit failures

Another step of #2508. Fixes #1811. Built on top of #2579.
> This makes me nervous.

Why? There's no need for a CSRF check there.

> No way around this?

[The docs](https://docs.balancedpayments.com/1.1/api/callbacks/#create-a-callback) say that callbacks can be sent as `GET` requests, which would slip through the CSRF check, but I'm not sure how that's any better.

> Also, how about `/callbacks/balanced` instead?

Good idea.