[s6pa1rta3n-lab]

Closes #559.

Summary of Changes

• Declared PUBLIC_INVOICE_FIELDS allowlist and SELLER_ONLY_INVOICE_FIELDS denylist in shared/invoice.ts.
• Enforced strict public DTO projection across public endpoints (GET /invoices/:id, GET /invoices/by-id/:id, GET /invoices/public/:id, POST /invoices/:id/verify, GET /invoices/:id/payment-info).
• Redacted customer and seller identity fields from payment audit event logs and structured event logging.
• Preserved seller workspace access to client contact details when authenticated with the seller wallet.
• Updated PaymentReceipt.tsx to dynamically evaluate proof email capability so public payers receive an accessible explanatory hint while seller workspace retains proof emailing.
• Fixed verify handler test mock with ledger close timestamp (created_at) to prevent settlement timestamp unavailability errors.
• Verified test suite passes across frontend, shared contracts, and accessibility checks.

Issue #559 Stipulations Checklist

• Whitelist public invoice fields (PUBLIC_INVOICE_FIELDS) on public pay, payment-info, and verify endpoints
• Redact seller and customer identity fields (SELLER_ONLY_INVOICE_FIELDS) from public responses, proof exports, and log events
• Preserve seller workspace access to customer contact details when authenticated via seller wallet
• Display clear unavailable hint for email proof action on public pay receipt while keeping action active on seller workspace
• Fix verify payment test fixture to include valid ledger close timestamp
• Preserve literal HTML escaping in invoice and proof PDF generators

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

[CemAyyildiz]

This can't be merged yet:

1. Merge conflicts with main (after feat: wire postgres storage into shared runtime and dual-run parity (#555) #577 landed).

2. Backend CI fails. Failing tests in the last run:

   • markAsPaid (payment attribution): attributes payment to the correct invoice / rejects attribution when already paid / getInvoiceById returns the paid state
   • getInvoiceStats: returns counts scoped to the requesting seller
   • [in-memory] cross-seller isolation: Seller B stats isolated from Seller A payment state; paying Seller A invoice does not appear in Seller B list or stats
   • [in-memory] dual-backend storage contract

   These look like the markAsPaid / settlement signature changes on main; rebasing first should make the real failures clearer.

Also note #561 targets the same issue (#559). Please rebase, get Backend — typecheck and tests green, then mark ready for review.