Add entity action and PDF download to invoices/quotes/credits/purchase-orders

These four resources are the only ones with the SDK's
entity_action_methods! route. Adds:

- `action <id> <action>` - mark_sent, mark_paid, archive, restore,
  clone_to_invoice, clone_to_quote, auto_bill, delete (routed), returning
  the updated record.
- `download <id>...` - the rendered PDF, to stdout or `--out <path>`;
  more than one id streams a single merged PDF (Invoice Ninja's bulk
  download action).

New EntityResourceArgs/EntityAction in cli.rs rather than extending the
existing ResourceArgs/Action: Rust enums don't compose, and every
resource's `run` match on Action needs to stay exhaustive without a
catch-all arm for variants it doesn't support.

Found and fixed along the way: the Download variant's --output <path>
field collided by name with the global --output table|json flag,
causing clap to panic at runtime trying to downcast the wrong type.
Renamed to --out.

Extended tests/nixos-test.nix to exercise action/download for real
against the VM. That caught a test-ordering bug of its own - asserting
mark_sent on an invoice *after* paying it off, which correctly doesn't
revert status_id from paid back to sent - fixed by reordering the
subtests. nix flake check passes clean.

Also backfills two CHANGELOG.md gaps from earlier sessions: the VM test
and CI additions had never actually been logged there.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -242,6 +242,22 @@ Each resource beyond `clients` should follow the same shape:
    either way; that's a separate addition.
 
 Resources with entity actions, document uploads, or non-CRUD endpoints
-(reports, charts, search, statics, PDF downloads, …) will need more than
-this template once they're added — the SDK's own `CLAUDE.md` describes which
-resources have which extras.
+(reports, charts, search, statics, …) will need more than this template
+once they're added — the SDK's own `CLAUDE.md` describes which resources
+have which extras.
+
+**Entity actions and PDF download are done** for the four resources that
+have the SDK's `entity_action_methods!` route (`invoices`, `quotes`,
+`credits`, `purchase_orders`): `EntityResourceArgs`/`EntityAction` in
+`src/cli.rs` is a second, parallel `ResourceArgs`/`Action` that adds
+`action <id> <action>` and `download <id>... [--out <path>]`. It
+duplicates `Action`'s five base variants rather than extending it — Rust
+enums don't compose, and every resource's `run` match on `Action` needs to
+stay exhaustive without a catch-all arm for variants it doesn't support.
+If a fifth resource ever gains this route, give it `EntityResourceArgs`
+too rather than writing a third near-duplicate enum.
+
+Still not done: bulk actions (`bulk_<resource>` — GOALS.md's open question
+on this covers why a plain pass-through isn't obviously right for bulk
+`delete`), document uploads (`upload_<resource>`), and the one-off
+non-CRUD endpoints (`statics`, `search`, `report`, `download_document`).