fix: billing portal session header and response format mismatch (#168)

Fixes GRO-261 — billing portal session header mismatch and response format bug.

- x-session-id → X-Impersonation-Session-Id in BillingPayments.tsx and Dashboard.tsx
- Handle bare array response from /api/portal/invoices

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/src/portal/sections/BillingPayments.tsx

@@ -46,7 +46,7 @@ export function BillingPayments({ sessionId, readOnly }: BillingPaymentsProps) {
       try {
         const response = await fetch("/api/portal/invoices", {
           headers: {
-            "x-session-id": sessionId,
+            "X-Impersonation-Session-Id": sessionId,
           },
         });
 
@@ -55,7 +55,7 @@ export function BillingPayments({ sessionId, readOnly }: BillingPaymentsProps) {
         }
 
         const data = await response.json();
-        setInvoices(data.invoices || []);
+        setInvoices(Array.isArray(data) ? data : data.invoices || []);
         setPaymentMethods(data.paymentMethods || []);
         setPackages(data.packages || []);
       } catch (err) {

apps/web/src/portal/sections/Dashboard.tsx

@@ -92,7 +92,7 @@ export function Dashboard({
 
       try {
         const headers = {
-          "x-session-id": sessionId,
+          "X-Impersonation-Session-Id": sessionId,
         };
 
         const [appointmentsRes, petsRes, invoicesRes, brandingRes] = await Promise.all([