feat: audit trail, batch invoices, webhook status, rate history

Audit Trail:
- Every invoice status change, creation, and refund logged with
  timestamp, actor, and before/after values
- Expandable audit timeline per invoice in the Invoices view
- Rate change history log (last 50 entries) with human-readable diffs

Invoice Improvements:
- Batch invoice generation: 'Generate All Invoices' creates one per account
  with progress tracking and sequential numbering
- Pre-flight check blocks export when institution profile incomplete
- Export Invoice button disabled during generation (prevents duplicates)
- Webhook status tracked per invoice (success/failed with timestamp)
- Webhook failures surfaced as UI errors, not just console.warn

UX Polish:
- State/Province changed to free text input (international support)
- Contact field asterisks now backed by real validation
- Webhook status column in invoice table (green check/red warning)

Author: Sqoia Dev Agent

src/ledger_util.py

@@ -5,6 +5,7 @@
 import os
 import shutil
 import sys
+from datetime import datetime
 
 LEDGER_PATH = '/etc/slurmledger/invoices.json'
 BACKUP_COUNT = 3
@@ -58,6 +59,13 @@ def update_invoice(invoice_id, patch):
                     print(json.dumps({"error": "InvalidTransition",
                         "message": f"Cannot change status from '{current}' to '{new_status}'"}))
                     sys.exit(1)
+                inv.setdefault('audit_log', []).append({
+                    'action': 'status_change',
+                    'from': current,
+                    'to': new_status,
+                    'by': os.environ.get('USER', 'unknown'),
+                    'at': datetime.utcnow().isoformat() + 'Z'
+                })
             inv.update(patch)
             break
     else:
@@ -80,6 +88,11 @@ def update_invoice(invoice_id, patch):
         update_invoice(args.invoice_id, patch)
     elif args.action == 'add':
         invoice = json.load(sys.stdin)
+        invoice.setdefault('audit_log', []).append({
+            'action': 'created',
+            'by': os.environ.get('USER', 'unknown'),
+            'at': datetime.utcnow().isoformat() + 'Z'
+        })
         data = read_ledger()
         data['invoices'].append(invoice)
         write_ledger(data)
@@ -90,6 +103,13 @@ def update_invoice(invoice_id, patch):
         for inv in data.get('invoices', []):
             if inv.get('id') == args.invoice_id:
                 inv.setdefault('refunds', []).append(refund)
+                inv.setdefault('audit_log', []).append({
+                    'action': 'refund_issued',
+                    'refund_id': refund.get('id', ''),
+                    'amount': refund.get('amount', 0),
+                    'by': os.environ.get('USER', 'unknown'),
+                    'at': datetime.utcnow().isoformat() + 'Z'
+                })
                 if refund.get('full'):
                     inv['status'] = 'refunded'
                 break