invoiceshelf: accounts are configured from the ui, not the environment

The same registry photos got: any number of labelled instances stored encrypted in
invoiceshelf_accounts, one selected, switchable from the nav. The token is write-only across
the sidecar boundary — the list has no field that could carry it back — and nothing reads
INVOICESHELF_URL/TOKEN/COMPANY_ID any more, so officer's own process.env no longer holds a
credential only the sidecar can use.

The company is pinned on the account row rather than resolved per request. InvoiceShelf's
`company` header does not error on a wrong or missing value; it silently returns another
company's books. So the choice is made once, at add time, and a token that can act for several
answers 409 with the list instead of guessing.

Both apps also take an email and password now, because neither service makes a key easy to get:
InvoiceShelf 2.4.2 ships no screen that issues tokens at all (POST /auth/login is the only way),
and Immich's is buried in account settings. The sidecar does the exchange — InvoiceShelf mints a
Sanctum token, Immich logs in, creates an all-permissions API key and closes the session again —
and stores only what comes back. The password is never persisted. Pasting a key still works.

Verified against the live instances: InvoiceShelf 2.4.2 and Immich 3.1.0, routes and DTOs read
from the running containers. The two sign-in paths are untested end to end — no second login to
try them with.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ecosystem.config.cjs

@@ -82,6 +82,10 @@ module.exports = {
       args: 'run src/servers/sidecar/transmission/index.ts',
       watch: false,
     },
+    // The books. Wraps a self-hosted InvoiceShelf. Instances, their Sanctum tokens and the company each one
+    // is pinned to are set by the owner from /invoices/settings and stored encrypted in
+    // `invoiceshelf_accounts` — read here, never from the environment, because Bun auto-loads `.env` into
+    // every process in this directory and `officer` would hold the token too.
     {
       name: 'officer-invoiceshelf',
       script: 'bun',