review

Blocker: The route allows any authenticated user to fetch any invoice by ID, violating the 'view their own invoices' requirement. Implement an owner-scoped query and return 404 for non-accessible resources to prevent data leakage. Add targeted tests to prove cross-user access is blocked before shipping.