fix: Add validation to prevent arbitrary invoice status values

[Jean-Regis-M]

Description

Adds input validation to update_invoice_status to ensure only predefined
status values can be persisted to the database.

Issue

Fixes #138

Changes Made

• Added VALID_INVOICE_STATUSES constant with allowed values
• Added validation check at the beginning of update_invoice_status
• Raises ValueError with helpful message for invalid statuses
• Maintains existing functionality for valid statuses

Testing

• test_inv_upd_005_arbitrary_status_accepted now passes
• All other invoice status tests (001-004) continue to pass
• Manual testing with valid statuses works as expected

Security Impact

Prevents prompt injection attacks that could bypass business logic by
setting arbitrary status values (e.g., "approved_bypass" to avoid detection).