How I bill per-invoice on a small GST SaaS — reserve, settle, refund — and the concurrency bug an audit found where two uploads could both spend the last credit.