invoices: cancel with stamped PDF, superuser-only hiding

An invoice issued by mistake could only be left pending or marked paid.
Add cancel (with an optional reason) and reinstate. Cancelling renders a
third PDF variant with a diagonal CANCELLED stamp and the date/reason,
and it becomes the current one, so the client's link and download show
the invoice as void. Cancelled wins over paid in the status, and marking
a cancelled invoice paid is refused.

Superusers can also hide an invoice: it disappears from the admin list,
dashboard and invoice pages for every other user, while the client's
public link keeps working.

Assisted-by: Claude:opus-5

views/admin/invoices/index.erb

@@ -24,7 +24,7 @@
             <tbody>
                 <% @invoices.each do |inv| %>
                     <tr>
-                        <td class="mono"><%= inv.number %></td>
+                        <td class="mono"><%= inv.number %><% if inv.hidden %> <span class="badge badge-hidden">hidden</span><% end %></td>
                         <td><%= inv.client_name %></td>
                         <td class="mono"><%= inv.issued_on.strftime('%Y-%m-%d') %></td>
                         <td class="num mono"><%= inv.currency %> <%= '%.2f' % inv.total %></td>