invoices: cancel with stamped PDF, superuser-only hiding

An invoice issued by mistake could only be left pending or marked paid.
Add cancel (with an optional reason) and reinstate. Cancelling renders a
third PDF variant with a diagonal CANCELLED stamp and the date/reason,
and it becomes the current one, so the client's link and download show
the invoice as void. Cancelled wins over paid in the status, and marking
a cancelled invoice paid is refused.

Superusers can also hide an invoice: it disappears from the admin list,
dashboard and invoice pages for every other user, while the client's
public link keeps working.

Assisted-by: Claude:opus-5

db/migrations/009_invoice_cancel_hide.rb

@@ -0,0 +1,9 @@
+Sequel.migration do
+  change do
+    alter_table(:invoices) do
+      add_column :cancelled_at,  DateTime                       # NULL = not cancelled
+      add_column :cancel_reason, String, text: true
+      add_column :hidden, TrueClass, null: false, default: false # admin: superusers only
+    end
+  end
+end