fix(orders): decode • so item options separate again

`•` was missing from the entity table, and that was not cosmetic.
DoorDash separates an item's name from its options with a bullet and
parseDoorDashLineItems splits on the literal "•" — so left encoded, the
split never happened and the line collapsed into the description:
"Bucket and Side Pack (Meal Deals) • Hot Bucket • Chips" with
options []. The entity showed on screen and the structure behind it was
gone.

Numeric entities are now decoded generically rather than one at a time,
which is how $ came to be listed individually while its neighbours
were not, and & resolves last so a literal "•" stays as
written instead of turning into a bullet.

Repaired the 47 stored rows by re-parsing the captured email behind each
one rather than string-replacing the entity, since a replacement would
have fixed the display and left options [] underneath. Rehearsed first:
all 47 re-parsed, all 47 gained options, 0 line items lost, 0 amounts
changed. Old values kept in dump/rollback-line-items-20260728-223737.json.

Pre-existing — 22 rows predate today — but the pre-cutover backfill more
than doubled the affected rows, which is what surfaced it. Verified in
the Order details panel, not in SQL.

src/__tests__/unit/order-ingestion.test.ts

@@ -488,3 +488,36 @@ describe("payment legs", () => {
     expect(validateOrderTotals(o, html("ut-paypal")).ok).toBe(true);
   });
 });
+
+describe("HTML entities in line items", () => {
+  it("splits options on an encoded bullet instead of swallowing it", () => {
+    // "<b>Sweet &amp; Sour Crunch</b> (…)<br><font>&bull; Sweet &amp; Sour
+    // Crunch 12 Pieces</font>". &bull; was not in the decode table, and
+    // parseDoorDashLineItems splits on the literal "•" — so the option never
+    // separated and the entity was rendered raw in the Order details panel.
+    const o = parseOrderHTML(
+      html("dd-bull-entity"),
+      meta({ subject: "Order Confirmation for Siddharth from Red Rooster" })
+    );
+    const all = JSON.stringify(o.line_items);
+    expect(all).not.toContain("&bull;");
+    expect(all).not.toContain("&amp;");
+
+    const item = o.line_items.find((i) => i.description.startsWith("Sweet"));
+    expect(item).toBeDefined();
+    // The ampersand decodes, and the bullet becomes a boundary, not text.
+    expect(item!.description).toContain("Sweet & Sour Crunch");
+    expect(item!.description).not.toContain("•");
+    expect(item!.options.length).toBeGreaterThan(0);
+  });
+
+  it("leaves a literal &amp;bull; alone rather than turning it into a bullet", () => {
+    // Why &amp; resolves last: decoding it first would rewrite text that was
+    // deliberately escaped.
+    const o = parseOrderHTML(
+      html("dd-01").replace("Mad Mex", "A&amp;amp;bull;B"),
+      meta()
+    );
+    expect(JSON.stringify(o)).not.toContain("A&bull;B".replace("&bull;", "•"));
+  });
+});