bug fixes and upgrades

Webapp issue — sign-in flow blocked on browser extension.

Symptom: when a user clicks "Sign in with TruHue" in the Chrome extension
popup, Chrome opens an OAuth flow window pointing at:

https://truhue.app/widget-auth?redirect=<chromiumapp_redirect_uri>

Chrome reports the error:
"[truhue] sign-in failed: Authorization page could not be loaded."

This means truhue.app/widget-auth either:
- returns a non-2xx HTTP status
- 404s (route doesn't exist)
- has DNS / hosting / cert issues
- crashes server-side

Things to verify and fix:

1. Open https://truhue.app/widget-auth in a regular browser — does the page
   load? What's the response status (DevTools → Network)?
2. If 404 or error: confirm the /widget-auth route is deployed in
   truhue-web/src/screens/WidgetAuth.jsx (or wherever) and Netlify is
   serving it.
3. If the page loads but errors: check Netlify deploy logs for build
   failures.
4. The /widget-auth page must:
5. Accept a ?redirect=<URL> query param
6. Show a Firebase Auth sign-in form (email/password, Google, etc.)
7. On successful sign-in:
   a) Mint a widget token via the widget-auth API endpoint
   (returns wgt_<hex> token, uid, email, season, tier, expiresAt)
   b) Redirect to the redirect URL with a fragment payload:
   <redirect>#token=wgt_xxx&uid=...&email=...&season=...&tier=...&webPro=0&expiresAt=...
8. Chrome's identity API intercepts the chromiumapp.org redirect and
   sends the URL fragment back to popup.js, which parses the token.
9. Acceptance: from the Chrome extension popup, clicking Sign in opens the
   web auth window, user signs in, window auto-closes, popup shows
   "Signed in as <email>" and the season auto-syncs.
10. While you're in there: please confirm truhue.app/admin/metrics is also
    reachable (the admin metrics page we built last week). If the whole
    site is down, that explains why both are broken.

Reference (extension side, no changes needed there):
~/Desktop/THue/truhue-widget/popup.js — signInWithTruHue() at line 65
Auth URL: https://truhue.app/widget-auth
Webapp token format: wgt_<hex>

Once you've verified /widget-auth loads + redirects correctly, ping me
and I'll re-test sign-in from the extension.

v1.10.0 — Save shades + scan history + scoring fixes
❤️ Save shades to your TruHue bag with one tap. Every scan now syncs to your account and shows up in your scan history.
Bug fixes:

Walmart / Target / Sephora — fixed a stale-state issue that could leave the badge stuck on a single label even when you switched shades.
Ulta — fixed lingering swatch dots after page changes.
Selected-shade scoring is now more accurate on every retailer (we now sample the selected swatch's actual color, not just its name).

Sign in to the TruHue widget from the popup to use save-to-bag and scan history. Anonymous users get the same badge experience as before.

Behavioral summary (changes from v1.9.3)
Bug fixes (5)

Bug fixes (5)

Stale dots fix — pre-scan sweep now clears .truhue-dot and .truhue-dot-overlay along with text badges. Pre-v1.10, dots from the 12 MutationObserver-triggered scans accumulated, making the visible color appear "stuck" on Walmart/Sephora/Target.
Walmart selected-shade selector — was matching the first .ml1 span across all variant chips (always returned chip 1 regardless of user pick). Now requires the chip to be aria-checked="true" / aria-pressed="true".
Selected-shade hex extraction — the textual badge path now uses selectedSwatchSelector to sample the chosen swatch's pixel color and pass it to the server. Catalog matches go from medium → high confidence.
Overlay positioner cleanup — _overlayPositioners map is now cleared on every sweep + on resetBadges(). Pre-v1.10 it leaked: ghost callbacks ran forever on scroll/resize.
BADGES_TOGGLED cache invalidation — toggle ON now drops dedupe Map so a true rescore happens (previously, off→on was DOM-clean only — same stale results).
New features (3) — Widget Master Dispatch

widgetToken state in content.js — read from chrome.storage.local at init, listens for chrome.storage.onChanged and WIDGET_TOKEN_UPDATED runtime messages.
logScanToHistory() — fire-and-forget POST to /.netlify/functions/log-scan after every successful score (signed-in users only). Anonymous users skip silently.
renderHeartButton() — 🤍 button next to the badge for save-to-bag (signed-in users only). Skips foundations (route to FoundationMatch flow). Optimistic UI; reverts on network error.