Add opt-in PDF snapshot links to invoice replies

[phucnguyen1707]

Summary

• Add githubInvoices.pdfEnabled, defaulting to false. Existing installations keep the same checkout-only reply.
• When explicitly enabled, derive the PDF snapshot URL from the configured CoinPay origin and validated published invoice ID. Do not fetch a PDF or trust an API-supplied external URL.
• Keep invoice creation, idempotency, fee flow, dry-run and contribution rewards unchanged. Include the rebuilt action bundle.

Verification

• 308 unit/flow tests passed.
• 39 workflow and built-action bundle tests passed.
• Typecheck and action build passed; the tracked bundle matches the build.
• Exact diff reviewed by Claude Opus; review corrections resolved before push.

Rollout

Leave the flag off until the portal's read-only /api/invoices/{id}/pdf endpoint is deployed and verified by the owner. This adds a download link, not a native GitHub file attachment. The PDF is a timestamped snapshot, not a receipt or proof of settlement. The live checkout link stays available independently.

No production invoices, email, payments or deployments were performed for this change.