Store a credential, encrypted; the value is never returned

Works only while the invoice is received, validated or queued. Since 0.18.3, once a send was tried and its answer was lost (a timeout or a 5xx), the invoice reads submitting and a cancel answers 409 send-in-progress, because the route may hold it; the worker settles it as submitted or dead_letter. Once the route has it, a cancellation is a business document (a credit note, or a KOR in Poland), not an API call. Since 0.18.5 a cancel of an invoice that is already cancelled answers 200 with it, so a retry after a lost answer is safe. Since 0.18.6 the operator's key may cancel a dead_letter invoice when no call to the route was ever made for it: nothing can be on the route, so the same document can be sent again afterwards. When a call was made, the answer is 409 dead-letter-reached-rail, because a send whose answer was lost may be there: check with the route first. A client's key gets 409 dead-letter; the operator decides.