Tattoo studio deposits, is it wrong that I store the card number myself?

Your instinct is right and this is the one thing you should stop today. The moment a raw card number touches your server you are in PCI scope: annual assessment, quarterly scans, real liability if that table leaks. Nobody at your size wants that.

The supported pattern keeps the number out of your stack entirely. Collect it with Stripe Elements or Checkout in the browser, create a Customer, and save the card with a SetupIntent using usage: 'off_session'. You store the customer id and the payment method id, both harmless strings. On the day of the appointment you charge with:

stripe.paymentIntents.create({
  amount: rest, currency: 'eur', customer, payment_method,
  off_session: true, confirm: true
})

Then drop the payment_methods columns and rotate nothing, because you never had anything worth rotating.