Harden invoice public links and tighten draft UI.

Use publicId in links, compact key-point/account labels, English business names, and readable favicon deploy perms.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/super-admin/src/services/invoiceService.ts

@@ -141,9 +141,9 @@ export function deleteBusinessInvoice(businessId: string, invoiceId: string) {
   })
 }
 
-/** Public show-page payload (no auth). */
-export function getPublicInvoice(invoiceId: string, signal?: AbortSignal) {
-  return apiRequest<PublicInvoice>(`/public/invoices/${invoiceId}`, {
+/** Public show-page payload (no auth). Lookup by opaque publicId. */
+export function getPublicInvoice(publicId: string, signal?: AbortSignal) {
+  return apiRequest<PublicInvoice>(`/public/invoices/${publicId}`, {
     auth: false,
     signal,
   })