fix(audit): profile_upsert top-key merge, scoring badge recordIds, zc item contract

- profile_upsert now merges top-level keys (info/resume/zongce are independent sub-documents); previously any page saving its own slice silently wiped the other two (profile save lost zongce rules, assessment save lost resume, resume save lost zongce)
- ZcItem gains recordIds: aggregated cap items (wcap/ccap/kcap/gcap/hcap) expose the records they aggregate, so the evidence gallery scored/unscored badge works (matchedIds was always empty before)
- add regression coverage notes; www rebuilt

app/server/db.mjs

@@ -1215,7 +1215,14 @@ function listFootprints(d, query) {
     case 'profile_upsert': {
       const p = payload;
       // 单行语义：更新现有行或插入首行
-      const content = JSON.stringify(p.content ?? {});
+      // 顶层 key 合并：info / resume / zongce 是相互独立的子文档，各页面只提交自己负责的
+      // key（ProfilePage 只有 info、AssessmentPage 有 info+zongce…），整行替换会让其他
+      // key 神秘消失；按顶层 key 合并后互不影响，key 内部整体替换（仍是全量提交该子文档）。
+      const existingRow = d.prepare('SELECT * FROM profile WHERE deleted_at IS NULL ORDER BY id DESC LIMIT 1').get();
+      let prev = {};
+      try { prev = JSON.parse(existingRow?.content || '{}'); } catch { prev = {}; }
+      const merged = { ...prev, ...(p.content ?? {}) };
+      const content = JSON.stringify(merged);
       const existing = d.prepare('SELECT * FROM profile WHERE deleted_at IS NULL ORDER BY id DESC LIMIT 1').get();
       withTx(d, () => {
         const h = hlcNext(d);