fix(notifications): district filter silently dropped every match

internal.py's flat-match path fed the raw scraper payload into
flat_matches_filter, which has no "district" key. Combined with the
match rule "active districts filter + unknown district → reject",
this meant any user with a non-empty districts filter stopped
receiving match notifications as soon as the 0011 migration ran.

Extract the Bezirk once from payload.address before the per-user
loop, so all users' filter evaluations see a concrete district.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/routes/internal.py

@@ -5,6 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException
 import db
 import enrichment
 import notifications
+from berlin_districts import district_for_address
 from common import _auto_apply_allowed, _kick_apply, require_internal
 from matching import flat_matches_filter, row_to_dict
 
@@ -27,11 +28,17 @@ async def internal_submit_flat(
     # Kick LLM enrichment + image download for this fresh flat.
     enrichment.kick(str(payload["id"]))
 
+    # Derive the Bezirk once so the districts filter can apply. Without
+    # this, flat_matches_filter sees district=None for every incoming
+    # flat and excludes it whenever a user has an active districts filter.
+    match_payload = dict(payload)
+    match_payload["district"] = district_for_address(payload.get("address"))
+
     for u in db.list_users():
         if u["disabled"]:
             continue
         filters = row_to_dict(db.get_filters(u["id"]))
-        if not flat_matches_filter(payload, filters):
+        if not flat_matches_filter(match_payload, filters):
             continue
 
         db.log_audit("alert", "flat_matched",