Align CI DB URLs with loopback-only disposable Postgres policy

[Copilot]

The validate GitHub Actions job failed because CI DB URLs used localhost while the disposable Postgres compatibility path enforces explicit loopback hosts. This PR updates CI/test DB connection settings to use 127.0.0.1 consistently and remove that mismatch.

• Problem alignment

  • Normalize DB host values from localhost to 127.0.0.1 where CI/test database URLs are defined.

• Workflow updates

  • .github/workflows/ci-cd.yml
    • Python test DATABASE_URL
    • Migration test DATABASE_URL

• Environment parity

  • config/environments/test.env
    • DATABASE_URL now uses 127.0.0.1 to match CI behavior.

# before
DATABASE_URL: postgresql://...@localhost:5432/cashnet_test

# after
DATABASE_URL: postgresql://...@127.0.0.1:5432/cashnet_test