Web source: crop to the widget's true content rect (union of visible body elements) — bounding box tight on all four sides, pinned to (0,0)

- QueryContentBoundsAsync now returns a real JS object (not JSON.stringify — ExecuteScriptAsync
  double-encodes strings, which silently killed the old crop) and measures the union of every
  visible body element's getBoundingClientRect: the widget's actual rect, top-left offset included.
- CaptureFrame crops AT that offset (x,y) instead of from (0,0), so the widget anchors at origin
  and the box is flush on right/bottom. Fill maps the frame flush under the box.

TASKS.md

@@ -917,16 +917,16 @@ capturing the primary display (which causes the infinity mirror effect).
 8. ✅ Preview shows live web content (not just a blank rectangle)
 9. ☐ Handle navigation errors, invalid URIs, timeout gracefully
 
-**Rendering model (2026-08-28, canvas-size viewport + content-bounds crop):**
-the page renders at the MASTER CANVAS size (1920×1080), stable, never tracked. Two earlier bugs
-are both dead: (a) box-sized viewports clip full-bleed widgets to their upper-left chunk
-("truncated to the upper-left corner regardless of scaling" — the image is desktop-line space),
-(b) dragging the box reflowed the page (truncation/scrollbars). Scrollbars suppressed via
-`overflow:hidden` html/body injection. After each navigation the manager queries the page's real
-content rect (`scrollWidth/scrollHeight` vs `innerWidth/innerHeight`) and **crops the capture to
-the actual content bounds, anchored at (0,0)**. `Stretch="Fill"` maps the frame flush under the
-box — selection/adornment box always bounds the widget, pinned to (0,0), for any widget geometry.
-Graceful-error handling (item 9) is a follow-up.
+**Rendering model (2026-08-28, canvas-size viewport + real-content-bounds crop):**
+the page renders at the MASTER CANVAS size (1920×1080), stable, never tracked (no reflow/truncation;
+scrollbars suppressed via `overflow:hidden`). After each navigation the manager measures the widget's
+ACTUAL visible content rect — union of every visible `body *` `getBoundingClientRect` (excludes the
+page's own margins/dead space, includes its top-left offset) — and **crops the capture to that rect**,
+anchoring the widget at (0,0). `Stretch="Fill"` maps the frame flush under the box: the selection
+box bounds the widget tight on all four sides and is pinned to (0,0) for any widget geometry.
+⚠️ `ExecuteScriptAsync` JSON-encodes the returned value — the script must return a real OBJECT (not
+`JSON.stringify`, which double-encodes → parse exception → crop silently skipped). Graceful-error
+handling (item 9) is a follow-up.
 
 **Properties panel (2026-08-28):** web URI ✓/✕ icon buttons are `IsTabStop="False"` so Tab flows
 X→Y→W→H→URI; the ✕ button now clears the URI textbox (was reverting to the pre-accept snapshot).