Download an invoice PDF from the subscription's Invoices tab

Streams the invoice document for one of the subscription's invoices ("Download invoice" in the detail page's Invoices tab). The UI lists the subscription's invoices with a per-row download button; this endpoint returns the rendered PDF for the invoice selected via the invoiceId query parameter. The download does not mutate the invoice or the subscription — the resulting state is identical for subsequent reads. Validation: billingSubscriptionId must identify a subscription visible to the caller in scopeId and invoiceId must reference an invoice belonging to that subscription (else 404 NOT_FOUND); the invoice must be in a downloadable state — the UI disables the button for CANCELLED invoices, which have no document, so a CANCELLED invoice maps to 409 CONFLICT; a missing invoiceId parameter maps to 422 VALIDATION_FAILED; the caller must hold at least the reader or billing role (else 403). Async & state: Synchronous read; no state change. The document is rendered (or fetched from the archive) and streamed inline; no operation is created and no resource.updated SSE frames are emitted. Errors: 401 unauthenticated; 403 role lacks billing read access in this scope; 404 unknown subscription or invoice id; 409 invoice is CANCELLED and has no downloadable document; 422 missing/malformed invoiceId; 500 document rendering or retrieval failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. Repeated downloads return byte-identical documents for the same finalized invoice.