fix: add amount validation to flag_invoice_for_review to reject negative invoices

[Jean-Regis-M]

Summary

Adds validation to flag_invoice_for_review to reject invoices with negative amounts.

Problem

The function currently accepts invoices with negative amounts (e.g., -500.0) without raising an error. This allows an attacker to create negative invoices that, when summed with positive ones, can artificially reduce a vendor's total invoice amount, potentially bypassing risk thresholds. The issue was identified by test case FRAUD-UPD-007.

Solution

After retrieving the invoice and confirming its existence, the function now checks if invoice.amount is not None and less than zero. If so, it raises a ValueError with a descriptive message. No other changes are made.

Impact

• Prevents negative‑amount invoices from being flagged for fraud review.
• Maintains all existing functionality for positive‑amount invoices.
• Adds a safeguard against a known manipulation vector.
• No breaking changes; existing tests for positive amounts continue to pass.

Testing

• Verified that test_fraud_upd_007_negative_amount_invoice_accepted_without_validation now passes (raises ValueError).
• Ran test_fraud_flag_001 through test_fraud_flag_004 to confirm positive‑amount flagging still works.
• Manual verification: calling flag_invoice_for_review with a negative amount raises the expected error.