invoices, extracted into plugins/invoices — the platform half

Ninth extraction, third resurrection. Switched off since 2026-08-13 with the
permission reduced to api: [], so assertPermissionTotality was satisfied, the
server booted clean, and every panel request 404'd. Closes the same data hazard
as jellyfin and soulseek: invoiceshelf/schema was commented out of the drizzle
barrel.

Named `invoices`, not `invoiceshelf`. The appName is THE id — API prefix,
frontend route, table prefix, sidecar suffix, install key — and before
extraction the API (/api/invoiceshelf) and the screen (/invoices) had drifted
apart, which was harmless only while they were separate hardcoded strings. The
route is the part a person sees, and the permission key and label were already
`invoices`, so the API prefix was the odd one out. Cost three call sites and a
table rename to invoices_accounts, which was free only because the table
existed on no server — verified before deciding, not after.

members.test.ts re-anchored again, this time to caldav and memos: services with
no extraction planned. That assertion has now been re-pointed four times by
services leaving for plugins/, which is the whole reason installer.test.ts was
made literal earlier tonight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/permissions/registry.ts

@@ -191,15 +191,6 @@ const CORE_REGISTRY: Permission[] = [
     // Device registration is the caller's own — a phone subscribing to its own push channel.
     personal: ['/devices', '/subscriptions'],
   },
-  {
-    key: 'invoices',
-    label: 'Invoices',
-    description: 'InvoiceShelf books',
-    kind: 'app',
-    // api: ['/invoiceshelf'],  // plugin — switched off 2026-08-13
-    api: [],
-    routes: ['/invoices'],
-  },
   // `vpn` (POST /api/vpn/enroll) was here until 2026-08-14 — the one member-grantable piece of headscale,
   // minting a pre-auth key bound to the caller. Deleted because it had no caller anywhere: the standalone
   // OffScale app gates it on `embedded`, which it never sets, and it never will — the app is permanently