feat(erp): read-only invoice export for ERPNext

ERPNext (collab.vycept.com) now picks up every shop invoice with its PDF,
books it as a Wabenhain sales invoice and matches it to the Stripe payment
via the PaymentIntent, so fees, revenue and the invoice document sit on one
booking.

- GET /api/erp/rechnungen?seit=<ISO>&limit=<1-200>: invoices oldest first,
  with order, payment intent, customer address (no phone, no notes), items
  and the VAT split per rate exactly as printed (lib/vat.ts), including the
  shipping and discount share per rate, so ERPNext books the same cents.
- GET /api/erp/rechnungen/<RE-YYYY-NNNN>/pdf: the stored invoice PDF.
- Bearer token ERP_EXPORT_TOKEN (min. 32 chars, timing-safe compare);
  without it the export is off. Failed attempts are rate limited.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

k8s/02-secret.example.yaml

@@ -115,6 +115,11 @@ stringData:
   # ab (alle 10 Minuten).
   APICORE_WEBHOOK_SECRET: ""
 
+  # Rechnungsexport fuer ERPNext (GET /api/erp/rechnungen, nur lesend): ERPNext
+  # holt damit die Rechnungen samt PDF ab. Mindestens 32 Zeichen, derselbe
+  # Wert steht in ERPNext als WABENHAIN_ERP_TOKEN. Leer = Export aus.
+  ERP_EXPORT_TOKEN: ""
+
   # DHL-Versandmarken (Admin -> Bestellung -> "DHL-Versandmarke"), siehe
   # .env.example fuer die vollstaendige Einrichtung. Leer = der Knopf meldet
   # "noch nicht konfiguriert", der Rest des Shops ist unberuehrt. Ob Sandbox