Kimai: API invoice endpoint missing customer-level access control (IDOR)

Kimai's invoice API endpoint allows team leads to view all invoices in the system, even those belonging to customers they shouldn't have access to. This happens because the system only checks if the user has permission to view invoices in general, but doesn't verify they actually work with that specific customer.

The GET /api/invoices/{id} endpoint implements role-based access control (ROLE_TEAMLEAD) but lacks customer-level ownership validation, resulting in an Insecure Direct Object Reference (IDOR) vulnerability. An authenticated user with ROLE_TEAMLEAD can enumerate and retrieve sensitive invoice data across all customers regardless of team assignment. This affects confidentiality of financial and business data across organizational boundaries.