fix(orders): match the card leg by masking, not by card brand

Backfill dry-run over 130 real messages surfaced one 422: 'payments sum to 1.17
but receipt states 16.50'. The receipt is a mixed Uber payment —
Uber Cash $1.17 + Westpac ••••8032 $15.33 — and the card regex only matched
Visa|MasterCard|American Express|Amex, so an issuer-named leg was dropped
entirely. validateOrderTotals correctly refused it rather than recording $1.17
as the cost of a $16.50 order.

Anchors on the ••••NNNN masking instead, which also covers the form already
seen in the corpus ('Mastercard ••••3893 (CBA Ultimate) CHF 51.23'). Fixture
and regression test added.

Also repoints .env.test at the current postgres-personal container IP and
documents why: the container publishes no host port, so the address changes on
every recreate and the whole integration suite fails with connection errors
until it is refreshed.

src/__tests__/unit/order-ingestion.test.ts

@@ -164,3 +164,20 @@ describe("order_reference anchoring", () => {
     expect(p.flags).toContain("order_uuid_ambiguous");
   });
 });
+
+describe("mixed Uber payment (issuer-named card leg)", () => {
+  it("captures both legs when the card is labelled by issuer, not brand", () => {
+    // Real receipt: Uber Cash $1.17 + Westpac ••••8032 $15.33 = $16.50.
+    // A brand allowlist (Visa|MasterCard|Amex) misses "Westpac" and drops the
+    // card half, leaving payments that do not account for the total.
+    const p = parseOrderHTML(
+      readFileSync(resolve(dir, "ue-mixed.html"), "utf-8"),
+      meta({ subject: "Your Friday morning order with Uber Eats", sender: "uber.com", receivedAt: "2026-01-09T09:26:44Z" })
+    );
+    expect(p.totals.total_charged).toBeCloseTo(16.50, 2);
+    expect(p.payment.credits_amount).toBeCloseTo(1.17, 2);
+    expect(p.payment.card_amount).toBeCloseTo(15.33, 2);
+    expect(p.payment.card_last4).toBe("8032");
+    expect(validateOrderTotals(p).ok).toBe(true);
+  });
+});