Apply S3 Tokens

Apply tokens to one upcoming invoice.

Synchronous on purpose: the client has to learn now that an invoice is no longer editable, rather than discovering later that their application silently did nothing.

Applying reserves the tokens; it writes no ledger transaction. The CONSUME lands only when the invoice finalizes, which is what makes editing and un-applying free.

Returns 409 invoice_no_longer_editable once the credit line is on the Stripe draft.