Add business-card photo intake to the Matrix bot (M3)

The intake bot now accepts a photo of a business card in the intake room and
turns it into the same new-investor proposal a typed note would. The only new
step is image -> text; everything downstream (parse, fuzzy match, in-thread
approval, log-communication write) is reused unchanged.

M3 was deferred only because Spark Control had no vision model. That blocker is
gone: the daily-driver Qwen is vision-capable under the same model id, and the
gateway forwards OpenAI multimodal content untouched, so no gateway/server/s9pk
change is needed -- this ships bot-only (git pull + rebuild on the Spark).

Transcribe-then-reuse (not vision-straight-to-JSON) is deliberate: the
transcription becomes the source text the email-integrity rule checks against,
so a mis-read address can't reach the CRM unapproved -- same guarantee as the
text path. Card commits tag source="matrix_card" for the audit log.

- llm.chat_vision: multimodal /v1/chat/completions, same model, same gateway
- spark.transcribe_card: faithful card->text, "" on a non-card (NONE sentinel)
- bot.on_image/handle_card: download image, transcribe, hand to handle_intake
- crm_client: source provenance overridable via the proposal's _source key
- tests: test_spark.py + a provenance case; 41/41 suite green

backend/matrix_intake/crm_client.py

@@ -175,7 +175,10 @@ def build_commit_payload(proposal):
         "body": note,
         "subject": "" if note.strip() else intent_label,
         "append_note": True,
-        "source": "matrix_intake",
+        # Provenance for the audit log: a typed note is "matrix_intake"; a scanned business card
+        # rides in on _source="matrix_card" (set by the bot's image handler). Default preserves
+        # the text path.
+        "source": proposal.get("_source") or "matrix_intake",
     }
     match_id = proposal.get("_match_id")
     if match_id: