Pay an open invoice

Charges the amount due for an UNPAID or OVERDUE invoice ("Pay invoice" on the invoice detail page, confirmed through the pay dialog). The charge targets the supplied payment method, or the scope's default card when paymentMethodId is omitted (the UI confirms "Charge {amount} to {brand} •••• {last4}"). On settlement the invoice transitions to PAID, a PAID event is appended to its payment timeline, and the outstanding-balance roll-up of the scope decreases by the invoice total. Validation: invoiceId must reference an invoice visible in the active scope (otherwise 404 NOT_FOUND); the invoice status must permit pay — only UNPAID or OVERDUE invoices are payable; PAID or CANCELLED invoices are rejected with 409 CONFLICT; paymentMethodId, when supplied, must reference an existing, non-expired payment method in the scope (otherwise 422 VALIDATION_FAILED); the caller must be authorized for billing commands (otherwise 403 FORBIDDEN). Async & state: Asynchronous; returns 202 with the invoice resource in its transitional state while the charge settles. Terminal outcomes: status PAID (a resource.updated SSE frame with kind: invoice, patch: {status: PAID} is emitted and a PAID timeline event is appended) or the invoice remains UNPAID/OVERDUE with a FAILED timeline event when the charge is declined. Errors: 401 unauthenticated; 403 caller lacks billing command permission; 404 unknown invoiceId in the scope; 409 invoice already PAID or CANCELLED (state does not permit pay); 422 unknown or expired payment method; 500 on payment-pipeline failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key returns the original 202 response and never double-charges the payment method. Concurrent pay attempts on the same invoice serialize on the invoice; the loser observes 409 CONFLICT once the first charge settles.