Add entity action and PDF download to invoices/quotes/credits/purchase-orders

These four resources are the only ones with the SDK's
entity_action_methods! route. Adds:

- `action <id> <action>` - mark_sent, mark_paid, archive, restore,
  clone_to_invoice, clone_to_quote, auto_bill, delete (routed), returning
  the updated record.
- `download <id>...` - the rendered PDF, to stdout or `--out <path>`;
  more than one id streams a single merged PDF (Invoice Ninja's bulk
  download action).

New EntityResourceArgs/EntityAction in cli.rs rather than extending the
existing ResourceArgs/Action: Rust enums don't compose, and every
resource's `run` match on Action needs to stay exhaustive without a
catch-all arm for variants it doesn't support.

Found and fixed along the way: the Download variant's --output <path>
field collided by name with the global --output table|json flag,
causing clap to panic at runtime trying to downcast the wrong type.
Renamed to --out.

Extended tests/nixos-test.nix to exercise action/download for real
against the VM. That caught a test-ordering bug of its own - asserting
mark_sent on an invoice *after* paying it off, which correctly doesn't
revert status_id from paid back to sent - fixed by reordering the
subtests. nix flake check passes clean.

Also backfills two CHANGELOG.md gaps from earlier sessions: the VM test
and CI additions had never actually been logged there.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -43,3 +43,13 @@ command line.
 - CI on GitHub Actions, mirroring `invoiceninja-sdk`'s own `ci.yml`: a
   pinned-toolchain `test` job, a build-only `msrv` job on the declared 1.88
   floor, and an advisory `stable` job.
+- `nixosConfigurations.invoiceninja-test-nginx`/`-caddy` (re-exported from
+  `invoiceninja-nixos`) and an automated `checks.invoiceninja-cli` nixosTest
+  that boots a real Invoice Ninja instance and runs this CLI's own binary
+  against it. See `CLAUDE.md`'s "Testing against a real server".
+- `invoices`/`quotes`/`credits`/`purchase-orders` gain `action <id>
+  <action>` (entity actions — `mark_sent`, `mark_paid`, `archive`,
+  `restore`, `clone_to_invoice`, `clone_to_quote`, `auto_bill`, `delete`)
+  and `download <id>...` (the rendered PDF, to stdout or `--out <path>`;
+  more than one id streams a single merged PDF). These four are the only
+  resources with the SDK's `entity_action_methods!` route.