Cover missing auth header rejection

[louiss72]

What changed

• Added integration coverage for protected invoice requests sent without an Authorization header.
• Verifies the existing 401 response shape and confirms invoice service logic is not invoked when auth is missing.

Note

The issue text references /api/invoices and Authentication header missing; this project currently exposes invoices under /api/v1/invoices and uses the existing error message Authorization token is required.. This PR tests the current API behavior without changing the response contract.

Validation

• npm test -- --runTestsByPath tests/integration/auth-jwt-validation.test.ts
• npm run type-check
• npm run lint

Closes #171