feat(billing): renewals, coupons, VAT numbering, billing cycles and invoice payment tracking

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/Providers/RouteServiceProvider.php

@@ -74,6 +74,11 @@ class RouteServiceProvider extends ServiceProvider
             return Limit::perMinute($key ? 300 : 60)->by($key ?: $request->ip());
         });
 
+        RateLimiter::for('invoice-lookup', fn (Request $request) => [
+            Limit::perMinute(10)->by('invoice-lookup|' . strtoupper((string) $request->input('invoice_number'))),
+            Limit::perMinute(30)->by('invoice-lookup|ip|' . $request->ip()),
+        ]);
+
         // Auth endpoint của khách (login/verify/forgot...). portal-client gọi API từ Next server nên
         // IP gần như luôn là IP của Next → khoá theo route + email, không theo IP (tránh chặn chung mọi khách).
         RateLimiter::for('client-auth', function (Request $request) {