invoices: cancel with stamped PDF, superuser-only hiding

An invoice issued by mistake could only be left pending or marked paid.
Add cancel (with an optional reason) and reinstate. Cancelling renders a
third PDF variant with a diagonal CANCELLED stamp and the date/reason,
and it becomes the current one, so the client's link and download show
the invoice as void. Cancelled wins over paid in the status, and marking
a cancelled invoice paid is refused.

Superusers can also hide an invoice: it disappears from the admin list,
dashboard and invoice pages for every other user, while the client's
public link keeps working.

Assisted-by: Claude:opus-5

lib/invoice.rb

@@ -24,7 +24,13 @@ class Invoice < Sequel::Model(:invoices)
     !paid_at.nil?
   end
 
+  def cancelled?
+    !cancelled_at.nil?
+  end
+
+  # Cancellation wins over payment: a cancelled invoice is no longer owed.
   def status
+    return 'cancelled' if cancelled?
     paid? ? 'paid' : 'pending'
   end