feat(api): Guarded Invoice PATCH Endpoint

[simplicityf]

What

Adds PATCH /api/invoices/:id with strict field-level access controls and status-aware edit permissions.

Why

Invoice records contain financially sensitive fields (amount, customer) that must become immutable once they enter the verification/funding pipeline. Without this guard, any authenticated caller could silently overwrite committed values or spoof system-managed fields like status and id.

How

A dedicated middleware (middleware/patchInvoice.js) owns all guard logic and is independently unit-tested:

• Allowlist — only amount, customer, and notes are ever writable; all other keys are stripped before any write occurs.
• Status lock — amount and customer are rejected with 422 once the invoice status is verified, funded, settled, or cancelled; notes remains editable throughout.
• Soft-delete guard — returns 409 if the invoice has been soft-deleted; caller must restore first.

Test coverage

42 tests, middleware/patchInvoice.js at 100% statement / branch / function / line coverage.

Security notes

Risk	Mitigation
Mass assignment	Strict MUTABLE_FIELDS allowlist; unknown keys discarded before write
Status spoofing	status not in allowlist; only a dedicated transition endpoint can change it
Prototype pollution	Object.prototype.hasOwnProperty.call guards throughout
Deleted record mutation	409 guard; restore required before update

Checklist

• Route implemented and wired
• Field guard middleware with JSDoc
• 42 tests (integration + unit)
• README updated
• No new dependencies

Related Issue

Closes #24

Screenshot

[drips-wave]

@simplicityf Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mikewheeleer]

Resolve the conflicts & revert the changes in package-lock.json

[simplicityf]

@mikewheeleer

[simplicityf]

@mikewheeleer kindly review

[simplicityf]

@mikewheeleer