fix(orders): match the card leg by masking, not by card brand

Backfill dry-run over 130 real messages surfaced one 422: 'payments sum to 1.17
but receipt states 16.50'. The receipt is a mixed Uber payment —
Uber Cash $1.17 + Westpac ••••8032 $15.33 — and the card regex only matched
Visa|MasterCard|American Express|Amex, so an issuer-named leg was dropped
entirely. validateOrderTotals correctly refused it rather than recording $1.17
as the cost of a $16.50 order.

Anchors on the ••••NNNN masking instead, which also covers the form already
seen in the corpus ('Mastercard ••••3893 (CBA Ultimate) CHF 51.23'). Fixture
and regression test added.

Also repoints .env.test at the current postgres-personal container IP and
documents why: the container publishes no host port, so the address changes on
every recreate and the whole integration suite fails with connection errors
until it is refreshed.

src/lib/order-parse.ts

@@ -226,8 +226,14 @@ function parsePayment(platform: string, html: string, text: string): PaymentBrea
 
   const cash = text.match(/Uber Cash\s*(?:[A-Z]{3})?\s*\$?([\d,]+\.\d{2})/i);
   if (cash) out.credits_amount = money(cash[1]);
+  // Anchor on the masking, not on a list of card brands. Uber labels the card
+  // leg with whatever the issuer is called — "Westpac ••••8032 $15.33",
+  // "Mastercard ••••3893 (CBA Ultimate) CHF 51.23" — so a brand allowlist
+  // silently drops the card half of a mixed payment. Found in the backfill
+  // dry-run: Uber Cash $1.17 + Westpac ••••8032 $15.33 against a $16.50 total,
+  // which validateOrderTotals correctly refused rather than under-recording.
   const card = text.match(
-    /(?:Visa|MasterCard|American Express|Amex)[^\d]*(\d{4})[^\d]*(?:[A-Z]{3})?\s*\$?([\d,]+\.\d{2})/i
+    /(?:••••|\*{4}|\u2022{4})\s*(\d{4})[^\d]{0,40}?\$?\s*([\d,]+\.\d{2})/
   );
   if (card) {
     out.card_last4 = card[1];