Add an automated VM test against a real Invoice Ninja instance

Adds an invoiceninja-nixos flake input and two things built from it:

- nixosConfigurations.invoiceninja-test-nginx/-caddy: manual test
  VMs, re-exported as-is from that repo rather than redefined here —
  same principle as this crate being a client of the SDK, not a
  second implementation of it.
- checks.invoiceninja-cli: an automated nixosTest (tests/, adapted
  from invoiceninja-nixos's own test scaffolding) that boots a real
  Invoice Ninja instance and runs the actual invoiceninja-cli binary
  against it - create/list/get/update/invoice/payment/delete across
  clients, invoices, and payments - rather than raw curl.

tests/common.nix's module import had to change from a relative
../nixos-module/invoiceninja.nix (which doesn't exist here) to a
parameter threaded from the flake input's nixosModules.invoiceninja.

Building the VM pulls from the invoiceninja-nixos cachix cache via a
nixConfig block, mirroring that repo's own.

Also fixes a wrong assumption the first version of this test's final
assertion made, caught by actually running it against a real server:
`clients list` with no `--status` does not exclude soft-deleted
records - confirmed empirically (Invoice Ninja returns everything
regardless of is_deleted unless status=active is passed explicitly).
Corrected the test to check is_deleted via `clients get` instead, and
fixed the misleadingly-incomplete --status doc comment in cli.rs that
had the same wrong assumption baked in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/nixos-test.nix

@@ -0,0 +1,103 @@
+{ nixpkgsPath, system, invoiceninjaModule, invoiceninjaCliPkg }:
+
+let
+  pkgs = import nixpkgsPath { inherit system; };
+
+  adminEmail = "admin@email.com";
+  adminPassword = pkgs.lib.strings.trim (builtins.readFile ./invoice_ninja_test_password);
+in
+pkgs.testers.nixosTest {
+  name = "invoiceninja-cli";
+
+  nodes = {
+    # Only one node/proxy backend: which proxy Invoice Ninja sits behind is
+    # invoiceninja-nixos's own concern (its checks exercise both nginx and
+    # caddy already). This test is about whether invoiceninja-cli works
+    # against a real server, which doesn't depend on which proxy fronts it.
+    machine = {
+      imports = [ (import ./common.nix { proxyServer = "nginx"; inherit invoiceninjaModule; }) ];
+      environment.systemPackages = [ invoiceninjaCliPkg ];
+    };
+  };
+
+  testScript = ''
+    import json
+
+    def api_post(machine, path, payload, token=None):
+        auth_header = f"-H 'X-API-TOKEN: {token}' " if token else ""
+        return json.loads(machine.succeed(
+            f"curl -sf -X POST http://localhost{path} "
+            + auth_header
+            + "-H 'Content-Type: application/json' "
+            + f"-d '{json.dumps(payload)}'"
+        ))
+
+    def cli(machine, token, *args):
+        quoted_args = " ".join(f"'{a}'" for a in args)
+        return machine.succeed(
+            f"IN_API_TOKEN={token} IN_BASE_URL=http://localhost/api/v1 "
+            f"invoiceninja-cli --output json {quoted_args}"
+        )
+
+    machine.start()
+
+    # phpfpm-invoiceninja/invoiceninja-queue-worker both Require= invoiceninja-data-setup,
+    # so systemd already waits for it to finish before either starts.
+    machine.wait_for_unit("mysql.service")
+    machine.wait_for_unit("redis-invoiceninja.service")
+    machine.wait_for_unit("phpfpm-invoiceninja.service")
+    machine.wait_for_unit("invoiceninja-queue-worker.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+
+    with subtest("admin account can log in via the API"):
+        login_response = api_post(machine, "/api/v1/login", {"email": "${adminEmail}", "password": "${adminPassword}"})
+        assert "${adminEmail}" in json.dumps(login_response), f"login did not succeed: {login_response}"
+        token = login_response["data"][0]["token"]["token"]
+
+    with subtest("invoiceninja-cli can create and list a client"):
+        cli(machine, token, "clients", "create", "--data", '{"name": "CLI Test Client"}')
+        listing = cli(machine, token, "clients", "list")
+        clients = json.loads(listing)
+        assert any(c["name"] == "CLI Test Client" for c in clients), f"client not in list output: {listing}"
+        client_id = next(c["id"] for c in clients if c["name"] == "CLI Test Client")
+
+    with subtest("invoiceninja-cli update preserves fields it wasn't told about"):
+        cli(machine, token, "clients", "update", client_id, "--data", '{"city": "Springfield"}')
+        updated = json.loads(cli(machine, token, "clients", "get", client_id))[0]
+        assert updated["city"] == "Springfield", f"city not updated: {updated}"
+        assert updated["name"] == "CLI Test Client", f"update blanked a field it wasn't told about: {updated}"
+
+    with subtest("invoiceninja-cli can create an invoice against that client and see it in a payment"):
+        invoice_out = cli(
+            machine, token, "invoices", "create", "--data",
+            json.dumps({
+                "client_id": client_id,
+                "line_items": [{"quantity": 1, "cost": 100, "product_key": "test-product"}],
+            }),
+        )
+        invoice = json.loads(invoice_out)[0]
+        assert invoice["amount"] == 100, f"unexpected invoice amount: {invoice}"
+
+        payment_out = cli(
+            machine, token, "payments", "create", "--data",
+            json.dumps({
+                "client_id": client_id,
+                "amount": invoice["amount"],
+                "invoices": [{"invoice_id": invoice["id"], "amount": invoice["amount"]}],
+            }),
+        )
+        payment = json.loads(payment_out)[0]
+        assert payment["applied"] == invoice["amount"], f"payment not fully applied: {payment}"
+
+    with subtest("invoiceninja-cli delete soft-deletes the client"):
+        cli(machine, token, "clients", "delete", client_id)
+        # Not `clients list`: Invoice Ninja's default /clients (no `status`
+        # param) returns every record regardless of is_deleted — confirmed
+        # against a real server, contrary to what CLAUDE.md's `--status`
+        # doc comment implies. Check the flag directly instead of relying
+        # on list-exclusion.
+        deleted = json.loads(cli(machine, token, "clients", "get", client_id))[0]
+        assert deleted["is_deleted"], f"delete did not set is_deleted: {deleted}"
+  '';
+}