feat: invoices — patient billing with installments + PDF export

Backend (new `invoice` RBAC resource, granted to clinicians + reception):
- invoices table (line items + installments as JSONB), types, zod validation,
  service (CRUD + splitIntoInstallments + auto invoice numbers), org-scoped
  REST routes mounted at /api/invoices, activity logging (migration 0015)

Frontend:
- lib/invoices.ts API client + money/date helpers
- /invoices page: list with KPIs and search, create/edit dialog (searchable
  patient combobox, inline line-item editor, live total), detail sheet to split
  a bill into equal monthly installments, delete, and Download PDF
- dependency-free PDF via a print-styled window (browser "Save as PDF")
- sidebar "Invoices" entry under the Patients group; "Added by AI" badge honored

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/invoices.ts

@@ -0,0 +1,138 @@
+import { Router } from "express";
+import { z } from "zod";
+
+import { HttpError } from "../lib/http-error.js";
+import { invoiceInputSchema } from "../lib/invoice-validation.js";
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import * as service from "../services/invoices.js";
+
+export const invoicesRouter = Router();
+
+// Invoices are clinic-wide billing records, gated by the caller's role.
+invoicesRouter.use(requireAuth, requireOrg);
+
+invoicesRouter.get(
+  "/",
+  requirePermission({ invoice: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await service.listInvoices(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+invoicesRouter.post(
+  "/",
+  requirePermission({ invoice: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = invoiceInputSchema.parse(req.body);
+      const created = await service.createInvoice(
+        req.organizationId!,
+        req.user!.id,
+        input,
+      );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created invoice ${created.number} for ${created.name}`,
+        entityType: "invoice",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
+      res.status(201).json(created);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+invoicesRouter.put(
+  "/:id",
+  requirePermission({ invoice: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = invoiceInputSchema.parse(req.body);
+      const updated = await service.updateInvoice(
+        req.organizationId!,
+        req.params.id as string,
+        input,
+      );
+      if (!updated) throw new HttpError(404, "Invoice not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated invoice ${updated.number}`,
+        entityType: "invoice",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
+      res.json(updated);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+const splitSchema = z.object({ count: z.coerce.number().int().min(1).max(36) });
+
+invoicesRouter.post(
+  "/:id/split",
+  requirePermission({ invoice: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const { count } = splitSchema.parse(req.body);
+      const updated = await service.splitIntoInstallments(
+        req.organizationId!,
+        req.params.id as string,
+        count,
+      );
+      if (!updated) throw new HttpError(404, "Invoice not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Split invoice ${updated.number} into ${count} installments`,
+        entityType: "invoice",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
+      res.json(updated);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+invoicesRouter.delete(
+  "/:id",
+  requirePermission({ invoice: ["delete"] }),
+  async (req, res, next) => {
+    try {
+      const ok = await service.deleteInvoice(
+        req.organizationId!,
+        req.params.id as string,
+      );
+      if (!ok) throw new HttpError(404, "Invoice not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted invoice",
+        entityType: "invoice",
+        entityId: req.params.id as string,
+      });
+      res.status(204).end();
+    } catch (err) {
+      next(err);
+    }
+  },
+);