Mark Invoice Ready

Lock one held invoice's applied S3 tokens. Does not send it, and is not what sends it.

The daily pass finalizes and emails every held invoice on its send date, locked or not (PRO-3535). What this changes is who may still alter the applied tokens before then: a locked invoice leaves the client's Next Billing surface, so this is how an operator makes an override stick. To send now, call /send-now, which exists as a separate endpoint precisely because that send cannot be undone.

Outstanding S3 credits are written to Stripe as part of this call, since an override is the usual reason to lock and leaves exactly the state the guard below refuses on. Still refused with 409 invoice_not_ready when a credit write is awaiting confirmation from Stripe, or when writing it here did not succeed — locking over an uncredited invoice would let it go out at full price while the client's tokens are consumed against a discount never given.