fix(issues): decode @mention entities without lockfile or new deps

- Drop entities package (CI blocks pnpm-lock.yaml on PRs; reset lockfile to master)
- Restore numeric + allowlisted named entity decoding in issues.ts
- Split Greptile mid-token & case into its own test with review comment

Made-with: Cursor

server/package.json

@@ -64,7 +64,6 @@
     "dotenv": "^17.0.1",
     "drizzle-orm": "^0.38.4",
     "embedded-postgres": "^18.1.0-beta.16",
-    "entities": "^8.0.0",
     "express": "^5.1.0",
     "hermes-paperclip-adapter": "0.1.1",
     "jsdom": "^28.1.0",