fix(config): account-filter provider gate drops rows with empty/wrong-case provider + NULL cloud_account_id #24

GetPurchaseHistoryFiltered / appendAccountPredicate (internal/config/store_postgres.go ~:1437) gates the external-id match on provider = $p. A purchase_history row with cloud_account_id IS NULL and provider = '' (empty) or wrong-case (e.g. 'AWS') + a matching account_id would be SILENTLY DROPPED (false-negative).

In normal flow this cannot happen: the only writer (internal/purchase/execution.go:~632, Provider: rec.Provider) writes lowercase providers and cloud_accounts.provider is also lowercase, so the pairing matches. So this is brittleness/defense-in-depth, not a live bug.

Fix (defensive)

Normalize provider case in the predicate (e.g. LOWER(provider) = LOWER($p)) and/or fall back to the "" unknown-provider group when a row's provider doesn't match a known cloud_accounts provider. Add a test row with empty/wrong-case provider.

Discovered during adversarial verification of LeanerCloud/cloud-commitments-cli#956 (proven via testcontainers: such rows are dropped).