door ingest: anchor card matching to the HeatSync hex-uid model

The inbound-ingest matcher read a stored card_uid as both decimal and hex,
which mis-attributed all-digit uids (a stored "16" is hex 0x16 = 22, but it
wrongly matched a decimal poll of card 16) and was conceptually wrong.
HeatSync stores the uid as hex (the grant encoder requires it) and the ?z
log / webhooks report the decimal card number, so cardMatchesEvent now
matches a reported decimal when hexInt(storedUid) equals it, and matches a
webhook card_uid by exact string. This removes the false positive while
keeping every legit match. Attribution is audit-only (never an access
decision) and inert until a space enables ingest; no migration.

Also records the pass-63/64 door-epic deploy state and the pass-65 audit in
the handoff log.

docs/ARCHITECTURE.md

@@ -630,8 +630,10 @@ H:M:E). Webhook: `POST /api/door/inbound/[connection]` (also
 controller/relay, authenticated by a per-connection bearer secret
 (`inbound_secret_ref`, a distinct vault secret from the outbound password,
 constant-time compared); body-size guarded, rate-limited, Zod-validated
-(≤100 events). Both resolve a presented card to a member via numeric
-hex/decimal equality (`cardUidsEquivalent`) and dedupe-insert through the
+(≤100 events). Both resolve a presented card to a member via the HeatSync
+hex-uid model (`cardMatchesEvent`: a stored hex `card_uid` matches when
+`hexInt(uid)` equals the reported decimal number, or a webhook uid matches
+exactly) and dedupe-insert through the
 service client: `door_access_log.dedupe_key` + the partial-unique
 `(connection_id, dedupe_key)` index make a re-poll or webhook retry a
 no-op, while NULL-keyed action rows stay unconstrained. The poll is