feat(blur): a privacy blur layer for the Live scene — boxes and circles over the desktop

Creator request 2026-11-01: a layer that hides part of the desktop from viewers. Box or circle,
drag/resize like any layer, one strength slider, several allowed.

**Z-order is policy, not preference.** `AddSource` inserts a blur directly above the background
and therefore below the brand logo, and `OnSceneElementsReordered` pushes any blur that ends up
above the brand back down. Nothing else in the app can move it into the brand's way.

**Overlap = the strongest single blur, never a stack.** `SceneCompositor.ApplyBlurLayers` collects
every visible blur the first time one is reached in the z-order, sorts them strongest-first, and
shares one coverage map: a pixel already covered by a stronger blur is skipped. Blurring
back-to-front would have produced something stronger than any slider setting allows, which is
exactly what was ruled out.

**One blur curve, shared with the webcam.** `RegionBlur` carries the constants the webcam blur
already used — downscale 4, radius 1–6 downscaled px, `RadiusFor(strength)` — and
`BackgroundEffectProcessor` now delegates to it instead of holding its own copy. The layer's
slider is the same 0–1 scale with the same 0.5 default, so "half strength" means the same blur in
both features. Cost is proportional to the blur's own rect, not the frame.

**Live scene only**, enforced in `AddSource` as well as the (+) menu (`CanAddBlur`), so a stale
menu item or a scripted call cannot plant one on BRB. `ElementKind.Dynamic`, so it is never baked
into the static base and every render path gets it — pump, preview, thumbnails, scene dump.

Persistence: `Source.BlurAmount` column + migration; shape rides the existing `ClipShape`.
Properties panel: Box | Circle plus the strength slider, gated on `IsBlurSelected`.

4 tests: outside the mask is byte-identical, inside loses its hard edges, a circle leaves its
box corners alone, and two identical stacked blurs equal one (the coverage map). Release builds
at 0 warnings.

docs/ai/frame-pipeline.md

@@ -787,6 +787,18 @@ Full suite 290/291 passing, the sole failure the pre-existing compositor pixel t
   blits it **last — above the branding flash** at `socialBarTop` (0 = top, `SourceRectHeight − barHeight` =
   bottom) in master space. `MainViewModel` owns the frame (`_socialBarFrame`, rebuilt by `RenderSocialBarFrame`
   on load/save/`NotifySocialsChanged`).
+- **Privacy blur layer (2026-11-01):** `SourceType.Blur` is a Live-scene element that blurs the
+  composed-so-far buffer inside a rect or ellipse — it hides part of the creator's desktop without
+  hiding the brand. `SceneCompositor` treats all visible blurs as ONE group the first time one is
+  reached in the z-order (`ApplyBlurLayers`), sorts them **strongest first** and passes a shared
+  coverage map to `RegionBlur.ApplyInPlace`, so an overlap resolves to the strongest single blur
+  rather than a blurred blur. `RegionBlur` shares the webcam's radius curve and constants
+  (`Downscale 4`, `MinRadius 1`, `MaxRadius 6`, `RadiusFor(strength)`), so a strength means the
+  same thing in both features; the webcam's `BackgroundEffectProcessor` delegates to it.
+  ⛔ Z-order is policy: `AddSource` inserts the blur directly above the background (below the brand
+  logo), and `OnSceneElementsReordered` moves any blur that ends up above the brand back down.
+  Blur is `ElementKind.Dynamic`, so it is never baked into the static base and every render path
+  (pump, preview, thumbnails, scene dump) gets it from the one compositor.
 - Known consideration: the pump reads the active scene on a background thread while the UI can still edit
   it; a concurrent-mutation exception is contained (logged + `Failed` + the pump stops) rather than
   crashing. The background thread + video pipeline is the new reality since this step.