feat: open organization OAuth scopes + frontend auto-inherit + fix vCard download

- Add organizations:read/write to ALLOWED_SCOPES and OAuth metadata
- Frontend handleSaveCard auto-inherits org summary (same as MCP path)
- Fix vCard download: replace data: URI with Blob URL (CSP compatible)
- Update manifest-loader fallback hashes for new Vite build

Author: iim0663418

.specify/specs/organization-profiles.md

@@ -183,7 +183,22 @@ When tools/call save_received_card with organization "台積電" and company_sum
 Then card.company_summary remains "自訂摘要" (not overwritten)
 ```
 
-#### Scenario 5.3: Cron backfill applies org profile to existing cards without summary
+#### Scenario 5.3: Frontend save card auto-inherits organization profile
+```gherkin
+Given organization "台積電" exists with summary "全球最大晶圓代工..."
+When frontend handleSaveCard with organization "台積電" and no company_summary
+Then card.company_summary is populated from organization profile
+And provenance marks it as source_type "inherited"
+```
+
+#### Scenario 5.4: Frontend save card with OCR-produced summary does not inherit
+```gherkin
+Given organization "台積電" exists with summary
+When frontend handleSaveCard with organization "台積電" and company_summary "OCR產出摘要"
+Then card.company_summary remains "OCR產出摘要" (not overwritten by org profile)
+```
+
+#### Scenario 5.5: Cron backfill applies org profile to existing cards without summary
 ```gherkin
 Given 5 cards with organization_normalized matching "台積電"
 And 3 of them have NULL company_summary

workers/public/css/tailwind.css

@@ -1307,17 +1307,23 @@ document.getElementById('save-vcard').addEventListener('click', () => {
     if (currentCardData) {
         const vcard = generateVCard(currentCardData);
 
-        // Safari iOS 不支援 Blob URL 下載，改用 data URI
-        const dataUri = 'data:text/vcard;charset=utf-8,' + encodeURIComponent(vcard);
-        const a = document.createElement('a');
-        a.href = dataUri;
-
         // 根據當前語言狀態決定檔名
         const name = typeof currentCardData.name === 'object'
             ? (currentLanguage === 'zh' ? (currentCardData.name.zh || currentCardData.name.en) : (currentCardData.name.en || currentCardData.name.zh))
             : currentCardData.name;
-        a.download = `${name || 'contact'}.vcf`;
+        const filename = `${name || 'contact'}.vcf`;
+
+        // Blob URL 下載（相容 CSP default-src 'self'，現代瀏覽器通用）
+        const blob = new Blob([vcard], { type: 'text/vcard;charset=utf-8' });
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = filename;
+        a.style.display = 'none';
+        document.body.appendChild(a);
         a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
         showNotification('vCard 已下載', 'success');
     } else {
         showError(currentLanguage === 'zh' ? '無法下載 vCard，請重新載入頁面' : 'Failed to download vCard, please reload the page');

workers/public/js/main.js

@@ -9,10 +9,10 @@
   // Fallback hashes — updated by build process or manually
   var FALLBACK = {
     'icons': 'icons.sS1r72aF.js',
-    'user-portal': 'user-portal.B9oIbRgM.js',
+    'user-portal': 'user-portal.IOU4A1v_.js',
     'index': 'index.Cl2MLZ2s.js',
     'admin-dashboard': 'admin-dashboard.uN8GgcOK.js',
-    'card-display': 'card-display.Bj1oh34R.js',
+    'card-display': 'card-display.BlK0n1Xf.js',
     'qr-quick': 'qr-quick.HcaXRGQV.js'
   };
 

workers/public/js/manifest-loader.js

@@ -10,7 +10,7 @@ const MCP_AUTH_STATE_PREFIX = 'mcp_auth_state:';
 const MCP_AUTH_CODE_PREFIX = 'mcp_auth_code:';
 const MCP_AUTH_STATE_TTL = 600; // 10 minutes
 const MCP_AUTH_CODE_TTL = 600;  // 10 minutes
-const ALLOWED_SCOPES = new Set(['received_cards:read', 'received_cards:write']);
+const ALLOWED_SCOPES = new Set(['received_cards:read', 'received_cards:write', 'organizations:read', 'organizations:write']);
 
 interface McpAuthState {
   client_id: string;

workers/src/handlers/mcp/oauth-authorize.ts

@@ -1,6 +1,6 @@
 import type { Env } from '../../types';
 
-const SCOPES = ['received_cards:read', 'received_cards:write'];
+const SCOPES = ['received_cards:read', 'received_cards:write', 'organizations:read', 'organizations:write'];
 const CACHE_CONTROL = 'public, max-age=3600';
 
 /** Use the request's origin so metadata URLs match the domain the client connected to */

workers/src/handlers/mcp/oauth-metadata.ts

@@ -222,6 +222,38 @@ export async function handleSaveCard(request: Request, env: Env, ctx: ExecutionC
         permanentUrl, thumbnailUrl, body.ocr_raw_text || null, now.toString()
       ).run();
 
+      // Auto-inherit org profile summary (if card has no company_summary)
+      if (body.organization && !body.company_summary) {
+        try {
+          const orgProfile = await env.DB.prepare(`
+            SELECT uuid, summary
+            FROM organizations
+            WHERE user_email = ? AND (
+              name_normalized = ? OR name LIKE ? OR name_en LIKE ?
+            )
+            LIMIT 1
+          `).bind(
+            user.email, organizationNormalized,
+            `%${body.organization}%`, `%${body.organization}%`
+          ).first<{ uuid: string; summary: string | null }>();
+
+          if (orgProfile?.summary) {
+            await env.DB.prepare(
+              `UPDATE received_cards SET company_summary = ? WHERE uuid = ?`
+            ).bind(orgProfile.summary, cardUuid).run();
+
+            // Record provenance (non-blocking)
+            try {
+              await env.DB.prepare(`
+                INSERT INTO field_history (entity_type, entity_uuid, field_name,
+                  old_value, new_value, source_type, client_id, user_email, changed_at)
+                VALUES ('card', ?, 'company_summary', NULL, ?, 'inherited', NULL, ?, ?)
+              `).bind(cardUuid, orgProfile.summary, user.email, now).run();
+            } catch { /* provenance failure must not block */ }
+          }
+        } catch { /* org lookup failure must not block card save */ }
+      }
+
       // Auto-extract tags based on organization field
       if (body.organization) {
         const tags = extractTagsFromOrganization(body.organization);