fix(lookup): read the fields the providers were already sending

Audit of every field a lookup returns against what OpsLog can store, prompted
by a report that HamQTH was not fetching the email.

The email was never broken: pinned now against a captured HamQTH answer, it
parses and reaches the QSO. The reported callsign simply has no public address
on HamQTH, which the empty field could not distinguish from a fault — so the
"[email protected]" placeholder is gone. A greyed-out sample address in the one
field an operator checks to see whether the lookup found one reads as a value.

Real gaps found and closed:

- web: the qso table has had the column since migration 0003 and no provider
  mapping ever read it. HamQTH sends <web>.
- picture: Result.ImageURL was documented "QRZ only" because HamQTH's element
  is <picture>, not <image>. It was there all along.
- zip: sent by both providers, read by neither.
- adr_name: used only as a fallback when a record carries neither nick nor
  name. Deliberately NOT preferred over <nick> — a log wants the name the
  operator goes by on the air, "Igor", not "Igor Vladimirovich Getman".

The parse tests use a real captured payload, including the stray <div> advert
the server injects into its own XML.

frontend/wailsjs/go/models.ts

@@ -1441,6 +1441,8 @@ export namespace lookup {
 	    cont?: string;
 	    email?: string;
 	    qsl_via?: string;
+	    web?: string;
+	    zip?: string;
 	    image_url?: string;
 	    source: string;
 	    // Go type: time
@@ -1468,6 +1470,8 @@ export namespace lookup {
 	        this.cont = source["cont"];
 	        this.email = source["email"];
 	        this.qsl_via = source["qsl_via"];
+	        this.web = source["web"];
+	        this.zip = source["zip"];
 	        this.image_url = source["image_url"];
 	        this.source = source["source"];
 	        this.fetched_at = this.convertValues(source["fetched_at"], null);