fix: use SQL func.replace instead of Python str.replace on column

LoyaltyCard.card_number is a SQLAlchemy column, not a string —
cannot call .replace() on it. Use func.replace() for the SQL query.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/services/card_service.py

@@ -63,13 +63,15 @@ class CardService:
 
     def get_card_by_number(self, db: Session, card_number: str) -> LoyaltyCard | None:
         """Get a loyalty card by card number."""
-        # Normalize card number (remove dashes)
+        from sqlalchemy import func
+
+        # Normalize card number (remove dashes/spaces)
         normalized = card_number.replace("-", "").replace(" ", "")
         return (
             db.query(LoyaltyCard)
             .options(joinedload(LoyaltyCard.program))
             .filter(
-                LoyaltyCard.card_number.replace("-", "") == normalized
+                func.replace(func.replace(LoyaltyCard.card_number, "-", ""), " ", "") == normalized
             )
             .first()
         )