Invoices by email for Cloud workspaces

Problem

Cloud customers get no invoice by email after a payment. Stripe's own receipt emails can only be switched on for the whole Stripe account, so a workspace that needs every invoice in its inbox (often its accounting team's) has to fetch them from the billing portal by hand, or ask support.

Proposal

Settings → License gets an Invoices by email switch for workspace admins (Cloud only, workspaces with a subscription):

off by default;
invoices go to the billing contact, or to another address the admin enters (e.g. accounting);
each paid invoice with an amount is emailed with the PDF attached, plus a link to Settings → License (sign-in required);
when the address changes, the previous recipient gets a short notice;
amcp invoices email [on|off] [--to <address> | --billing-contact] in the CLI, and GET/PUT /api/license/invoice-email in the management API.

The licence site (which owns Stripe) stores the setting on the workspace's licence and sends the emails; the Cloud relays the admin's choice with its service token.

Tenant isolation

The workspace and the licence key come from the session, never from the request; the site checks again that the key is bound to that workspace (404 otherwise).
Sending starts from the paid invoice, re-read from Stripe, and follows its own subscription to its own licence; the subscription's customer must match the invoice's. No recipient is ever looked up by address or across licences.
The setting records the workspace it was made for: a key moved to another workspace stops sending.
One email per invoice (unique log entry), one recipient, no cc/bcc.