fix(orders): decode • so item options separate again

`•` was missing from the entity table, and that was not cosmetic.
DoorDash separates an item's name from its options with a bullet and
parseDoorDashLineItems splits on the literal "•" — so left encoded, the
split never happened and the line collapsed into the description:
"Bucket and Side Pack (Meal Deals) • Hot Bucket • Chips" with
options []. The entity showed on screen and the structure behind it was
gone.

Numeric entities are now decoded generically rather than one at a time,
which is how $ came to be listed individually while its neighbours
were not, and & resolves last so a literal "•" stays as
written instead of turning into a bullet.

Repaired the 47 stored rows by re-parsing the captured email behind each
one rather than string-replacing the entity, since a replacement would
have fixed the display and left options [] underneath. Rehearsed first:
all 47 re-parsed, all 47 gained options, 0 line items lost, 0 amounts
changed. Old values kept in dump/rollback-line-items-20260728-223737.json.

Pre-existing — 22 rows predate today — but the pre-cutover backfill more
than doubled the affected rows, which is what surfaced it. Verified in
the Order details panel, not in SQL.

src/lib/order-parse.ts

@@ -101,14 +101,35 @@ export class OrderParseError extends Error {
 
 const stripTags = (s: string) => s.replace(/<[^>]+>/g, " ");
 
+/**
+ * Entity decoding, ordered so `&amp;` resolves last.
+ *
+ * `&bull;` was missing, and it is not a cosmetic omission: DoorDash separates
+ * an item's name from its options with a bullet, and parseDoorDashLineItems
+ * splits on the literal "•". Left encoded, the split never happens and the
+ * whole line collapses into the description — "Fire Extinguisher (Chicken
+ * Burgers) &bull; Regular" instead of a name plus one option. So the entity
+ * showed up on screen AND the structure behind it was lost.
+ *
+ * Numeric entities are decoded generically rather than one at a time, which is
+ * how &#36; came to be listed individually while its neighbours were not.
+ *
+ * `&amp;` goes last because decoding it first turns a literal "&amp;bull;" —
+ * text that should stay as written — into a bullet.
+ */
 const decodeEntities = (s: string) =>
   s
     .replace(/&nbsp;/gi, " ")
-    .replace(/&amp;/gi, "&")
     .replace(/&#39;|&apos;/gi, "'")
     .replace(/&quot;/gi, '"')
-    .replace(/&#36;/g, "$")
-    .replace(/&hellip;/gi, "…");
+    .replace(/&hellip;/gi, "…")
+    .replace(/&bull;/gi, "•")
+    .replace(/&middot;/gi, "·")
+    .replace(/&ndash;/gi, "–")
+    .replace(/&mdash;/gi, "—")
+    .replace(/&#x([0-9a-f]+);/gi, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(parseInt(d, 10)))
+    .replace(/&amp;/gi, "&");
 
 const collapse = (s: string) => s.replace(/\s+/g, " ").trim();