invoices, extracted into plugins/invoices — the platform half

Ninth extraction, third resurrection. Switched off since 2026-08-13 with the
permission reduced to api: [], so assertPermissionTotality was satisfied, the
server booted clean, and every panel request 404'd. Closes the same data hazard
as jellyfin and soulseek: invoiceshelf/schema was commented out of the drizzle
barrel.

Named `invoices`, not `invoiceshelf`. The appName is THE id — API prefix,
frontend route, table prefix, sidecar suffix, install key — and before
extraction the API (/api/invoiceshelf) and the screen (/invoices) had drifted
apart, which was harmless only while they were separate hardcoded strings. The
route is the part a person sees, and the permission key and label were already
`invoices`, so the API prefix was the odd one out. Cost three call sites and a
table rename to invoices_accounts, which was free only because the table
existed on no server — verified before deciding, not after.

members.test.ts re-anchored again, this time to caldav and memos: services with
no extraction planned. That assertion has now been re-pointed four times by
services leaving for plugins/, which is the whole reason installer.test.ts was
made literal earlier tonight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/theme-baseline.json

@@ -9,7 +9,6 @@
   "src/workspaces/officerdev/src/apps/Dav": 7,
   "src/workspaces/officerdev/src/apps/FileBrowser": 15,
   "src/workspaces/officerdev/src/apps/FileViewer": 38,
-  "src/workspaces/officerdev/src/apps/Invoices": 95,
   "src/workspaces/officerdev/src/apps/Preview": 4,
   "src/workspaces/officerdev/src/apps/QrTransfer": 5,
   "src/workspaces/officerdev/src/apps/SystemMonitor": 1,