feat(mobile): standardize money typography and semantic amount color (#2331)

* feat(mobile): standardize money typography and semantic amount color

Add a brightness-aware SureColors theme extension and a MoneyText/SureMoney
primitive (semantic success/destructive/subdued tokens + tabular figures for
column-aligned digits), then migrate the transaction lists and balance cards
off raw Colors.green/red/grey.

Step 2 of the mobile design-system sequence (#2235), after #2237's theme
foundation. Primitive-first: screens consume shared tokens/typography.

* fix: review feedback — brightness-aware token fallback, de-flake Setting tests, Pipelock localhost FP

- SureColors.of falls back to the palette matching the active brightness (not
  always light) when the extension is missing, so dark surfaces stay correct.
- Clear the rails-settings-cached cache before each test; its in-memory cache
  survives the per-test transaction rollback, leaking Setting.* across tests and
  flaking Settings::HostingsControllerTest (stale empty string vs nil).
  Full unit suite: 4952 runs, 0 failures.
- Suppress the localhost test-DB DATABASE_URL false positive with line-level
  `# pipelock:ignore` in ci.yml + llm-evals.yml instead of excluding whole files,
  so those workflows stay scanned for real secrets.

.github/workflows/ci.yml

@@ -90,7 +90,7 @@ jobs:
     env:
       PLAID_CLIENT_ID: foo
       PLAID_SECRET: bar
-      DATABASE_URL: postgres://postgres:postgres@localhost:5432
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432 # pipelock:ignore
       REDIS_URL: redis://localhost:6379
       RAILS_ENV: test
 
@@ -141,7 +141,7 @@ jobs:
     env:
       PLAID_CLIENT_ID: foo
       PLAID_SECRET: bar
-      DATABASE_URL: postgres://postgres:postgres@localhost:5432
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432 # pipelock:ignore
       REDIS_URL: redis://localhost:6379
       RAILS_ENV: test
 

.github/workflows/llm-evals.yml

@@ -11,7 +11,7 @@ permissions:
 env:
   EVAL_MODELS: gpt-4.1
   RAILS_ENV: test
-  DATABASE_URL: postgres://postgres:postgres@localhost:5432
+  DATABASE_URL: postgres://postgres:postgres@localhost:5432 # pipelock:ignore
   REDIS_URL: redis://localhost:6379
   PLAID_CLIENT_ID: foo
   PLAID_SECRET: bar