feat(blur): a privacy blur layer for the Live scene — boxes and circles over the desktop

Creator request 2026-11-01: a layer that hides part of the desktop from viewers. Box or circle,
drag/resize like any layer, one strength slider, several allowed.

**Z-order is policy, not preference.** `AddSource` inserts a blur directly above the background
and therefore below the brand logo, and `OnSceneElementsReordered` pushes any blur that ends up
above the brand back down. Nothing else in the app can move it into the brand's way.

**Overlap = the strongest single blur, never a stack.** `SceneCompositor.ApplyBlurLayers` collects
every visible blur the first time one is reached in the z-order, sorts them strongest-first, and
shares one coverage map: a pixel already covered by a stronger blur is skipped. Blurring
back-to-front would have produced something stronger than any slider setting allows, which is
exactly what was ruled out.

**One blur curve, shared with the webcam.** `RegionBlur` carries the constants the webcam blur
already used — downscale 4, radius 1–6 downscaled px, `RadiusFor(strength)` — and
`BackgroundEffectProcessor` now delegates to it instead of holding its own copy. The layer's
slider is the same 0–1 scale with the same 0.5 default, so "half strength" means the same blur in
both features. Cost is proportional to the blur's own rect, not the frame.

**Live scene only**, enforced in `AddSource` as well as the (+) menu (`CanAddBlur`), so a stale
menu item or a scripted call cannot plant one on BRB. `ElementKind.Dynamic`, so it is never baked
into the static base and every render path gets it — pump, preview, thumbnails, scene dump.

Persistence: `Source.BlurAmount` column + migration; shape rides the existing `ClipShape`.
Properties panel: Box | Circle plus the strength slider, gated on `IsBlurSelected`.

4 tests: outside the mask is byte-identical, inside loses its hard edges, a circle leaves its
box corners alone, and two identical stacked blurs equal one (the coverage map). Release builds
at 0 warnings.

Models/Source.cs

@@ -18,7 +18,10 @@ public enum SourceType
     MediaSource,
     /// <summary>The designated alert zone: the six monetization events play their
     /// unique celebration animations here (OBS alert-box equivalent, native).</summary>
-    AlertBox
+    AlertBox,
+    /// <summary>A privacy blur: blurs the frame beneath it inside a rect or ellipse. Live scene
+    /// only, always below the brand logo, several allowed (strongest wins on overlap).</summary>
+    Blur
 }
 
 /// <summary>Distinguishes how a media source presents its content (TASK 21).</summary>
@@ -86,6 +89,7 @@ public class Source : SceneElement
     /// <summary>Live captures, chat, web sources and media are dynamic; static art is fixed.</summary>
     public override ElementKind Kind => Type is SourceType.DisplayCapture or SourceType.WindowCapture
         or SourceType.ChatBox or SourceType.WebSource or SourceType.MediaSource or SourceType.AlertBox
+        or SourceType.Blur
         ? ElementKind.Dynamic : ElementKind.Static;
 
     public override bool IsWebSource => Type == SourceType.WebSource;
@@ -158,6 +162,22 @@ public class Source : SceneElement
 
     // Countdown config
     private int _timerMinutes = 15;
+
+    // Privacy blur (Live scene only): 0–1, the same scale and default as the webcam's background
+    // blur so "half strength" means the same blur in both places.
+    private double _blurAmount = 0.5;
+    public double BlurAmount
+    {
+        get => _blurAmount;
+        set => Set(ref _blurAmount, Math.Clamp(value, 0, 1));
+    }
+
+    public bool IsBlur => Type == SourceType.Blur;
+
+    /// <summary>True for a round blur (circle) — the shape rides the existing clip surface, so the
+    /// box/circle choice is the same switch every other layer uses rather than a second concept.</summary>
+    public bool IsRoundBlur => IsBlur && ClipShape == ClipShape.Round;
+
     public int TimerMinutes
     {
         get => _timerMinutes;