Fix the invoice lookup scoped to a company

An AI added a Django view that returns an invoice as JSON. The URL required a login, so the team assumed it was safe, until a customer changed the id in the URL and read another company's invoice. Each company numbers its own invoices, so the same invoice id can exist at several companies. The lookup must be scoped to the requester's company.

An assistant wrote lookup_invoice_for_org(records, requester_org, invoice_id). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• records: the invoice table, one string per row, written invoice_id|org|amount, such as inv-1|acme|12000.
• requester_org: the company of the logged-in user, or "" when it is unknown.
• invoice_id: the id from the URL.
• Return the amount text of the matching row, exactly as written, or "404".

Rules the tests check:

• If requester_org or invoice_id is empty, return "404".
• Split each row on |. Skip a row that does not have exactly 3 parts. Nothing is trimmed, and everything compares exactly, case included.
• A row matches when its invoice id equals invoice_id and its org equals requester_org.
• Return the amount of the first matching row.
• With no matching row, return "404". That includes an invoice id that exists only at other companies, so the response never reveals which ids exist.