Add temporary PDF preview links via public token TTL

- Schema: add publicTokenExpiresAt to invoices table
- invoices.generatePublicToken: accepts optional ttlHours param; sets
  expiry timestamp when provided
- invoices.getByPublicToken: returns 403 if token is expired
- New route GET /api/i/[token]/pdf: streams the invoice PDF publicly,
  returns 410 Gone if expired; excluded from auth middleware
- MCP invoices_generate_public_token: exposes ttlHours, returns both
  webUrl (/i/{token}) and pdfUrl (/api/i/{token}/pdf)

https://claude.ai/code/session_014126WHVRT8mftmqkU6dajG

src/server/db/schema.ts

@@ -367,6 +367,7 @@ export const invoices = createTable(
       .notNull()
       .references(() => users.id),
     publicToken: d.varchar({ length: 255 }).unique(),
+    publicTokenExpiresAt: d.timestamp(),
     lastReminderSentAt: d.timestamp(),
     createdAt: d
       .timestamp()