Add integration test for a seller being unable to view analytics for an invoice they do not own

[Chucks1093]

Summary

The invoice analytics endpoint (views, click-throughs, investor interest) must be scoped strictly to the owning seller. An integration test should confirm that a different authenticated seller receives a 403 when requesting analytics for another seller's invoice.

Scope

• Seed an invoice owned by seller A with analytics data
• Authenticate as seller B and call the analytics endpoint for seller A's invoice
• Assert 403 is returned with error code forbidden
• Authenticate as seller A and confirm the same endpoint returns 200
• Assert an unauthenticated request returns 401

Acceptance Criteria

• Seller B receives 403 for seller A's invoice analytics
• Seller A receives 200 for their own invoice analytics
• Unauthenticated request returns 401
• Error code is forbidden on 403 response

ETA: 12 hours

---

Coordinate on Telegram