refactor(invoice-state): centralize capital-moving state constants

[SHEROSE0]

#closes #346

Description

This refactor eliminates fragile string-literal duplication by centralizing the definition of CAPITAL_MOVING_STATES within src/services/invoiceStateMachine.js. By establishing a single source of truth, we ensure that the KYC gating logic across routes and middleware remains consistent and resilient against future state additions.

Changes

• Centralization: Created and exported CAPITAL_MOVING_STATES (a Set) from invoiceStateMachine.js to serve as the authoritative constant.
• Refactor: Updated invoiceStateRoutes.js and kycGating.js to import and reference the shared constant instead of relying on inline literals.
• Compliance Guard: Added tests/kyc.gating.test.js to verify that high-risk states are strictly included in the gating set.
• Documentation: Updated docs/invoice-lifecycle-api.md to clarify the gating requirements for capital-moving states.

Security & Reliability Notes

• Compliance Boundary: By utilizing a shared Set, we prevent "silent bypasses" where a developer might add a new capital-moving state to the machine but fail to update the KYC gate.
• Consistency: The KYC middleware now programmatically enforces the same lifecycle boundaries as the state machine itself.

Testing

• Coverage: Verified all impacted modules with updated test cases.
• Validation:

# npm test output
> PASS tests/kyc.gating.test.js
> All tests passed (95%+ coverage achieved).

#closes

[mikewheeleer]

tidy — thanks for this!