update docs

docs/mibapi/05-cards.md

@@ -71,6 +71,8 @@ Referer: https://faisamobilex-wv.mib.com.mv//debitCards?dashurl=1
 | `phoneNumber` | `string` | Registered phone number |
 | `cardHolderName` | `string` | Name on card |
 
+> The app's `MibCard` model adds two **app-internal** fields not present on the server payload: `loginTag` (e.g. `"mib_<username>"`) and `profileId` (the active profile that fetched the card). They are populated by the client (`MibCardsClient.kt:66-67`) and used by the UI to map a card back to its owning login.
+
 ### Failure
 
 ```json
@@ -79,6 +81,44 @@ Referer: https://faisamobilex-wv.mib.com.mv//debitCards?dashurl=1
 
 ---
 
+## Freeze / Unfreeze Card
+
+```
+POST https://faisamobilex-wv.mib.com.mv/ajaxDebitCard/freeze
+POST https://faisamobilex-wv.mib.com.mv/ajaxDebitCard/unfreeze
+```
+
+Two endpoints — same shape. Pick by intent. Source: `MibCardsClient.kt:74-103`.
+
+```
+Referer: https://faisamobilex-wv.mib.com.mv//debitCards/manage?cardId=<cardId>&dashurl=1
+```
+
+### Request Body (form-urlencoded)
+
+| Field | Description |
+|---|---|
+| `cardId` | Card identifier from `fetchCardInfos` |
+| `comments` | User-supplied reason (free text; may be empty) |
+
+### Response
+
+```json
+{
+  "success": true,
+  "reasonText": "Card frozen successfully",
+  "currentStatusCode": "F"
+}
+```
+
+| Field | Description |
+|---|---|
+| `success` | `true` on success |
+| `reasonText` | Human-readable message (also returned on failure — show to user) |
+| `currentStatusCode` | New card status code after the action (e.g. `"F"` = frozen, `"A"` = active) |
+
+---
+
 &nbsp;
 
 ---