fix: billing tenant isolation, invoice status validation, SMTP password masking

H2: list_invoices now passes tenant_id (from current_user) to get_invoices;
    get_invoices applies WHERE tenant_id filter for non-global-admin users;
    get_invoice_endpoint returns 404 when tenant mismatch for non-admins.

H3: InvoiceStatusUpdate.status changed to Literal["draft","sent","paid","cancelled"]
    for schema-level validation; guard also added in update_invoice_status service.

H5: _settings_to_out masks smtp_password as "***" when set, "" when empty;
    update_settings skips writing when value is the "***" sentinel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/billing/router.py

@@ -6,7 +6,8 @@ from fastapi.responses import Response
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database import get_db
-from app.utils.auth import require_admin_or_pm
+from app.utils.auth import require_admin_or_pm, _role_value
+from app.domains.auth.models import ADMIN_ROLES
 from app.domains.billing.schemas import InvoiceCreate, InvoiceOut, InvoiceStatusUpdate
 from app.domains.billing.service import (
     create_invoice, get_invoices, get_invoice,
@@ -26,7 +27,8 @@ async def list_invoices(
     db: AsyncSession = Depends(get_db),
     current_user=Depends(require_admin_or_pm),
 ):
-    return await get_invoices(db, skip=skip, limit=limit)
+    tenant_id = None if _role_value(current_user) in ADMIN_ROLES else getattr(current_user, "tenant_id", None)
+    return await get_invoices(db, tenant_id=tenant_id, skip=skip, limit=limit)
 
 
 @invoice_router.post("/invoices", response_model=InvoiceOut, status_code=status.HTTP_201_CREATED)
@@ -57,6 +59,10 @@ async def get_invoice_endpoint(
     inv = await get_invoice(db, invoice_id)
     if not inv:
         raise HTTPException(status_code=404, detail="Invoice not found")
+    if _role_value(current_user) not in ADMIN_ROLES:
+        user_tenant = getattr(current_user, "tenant_id", None)
+        if inv.tenant_id != user_tenant:
+            raise HTTPException(status_code=404, detail="Invoice not found")
     return inv