feat(chroma): offer to remove a green or blue screen, and key it in the decode

TASK 64 slices D and E: the feature is usable end to end.

- Add a video file → one frame is probed (new `IChromaProbe`/`FfmpegChromaProbe`, one ffmpeg
  pass at 160x90, off the UI thread) and the layer gets an offer: "Looks like a green screen —
  Remove it", with the measured colour as a swatch.
- Accepting it turns the offer into settings (Amount / Softness / Fringe) that reach ffmpeg as
  `colorkey` + `despill` + `format=bgra`, so the key is computed in the pipe and both consumers
  (the shared preview bitmap and the compositor's frame) carry the same alpha.
- Media sessions are now keyed by **path + look** (`MainViewModel.MediaSessionKey`), so two
  layers with the same settings still share one decoder, and changing the look releases the old
  session and starts the new one. Removal, load reconciliation, loop and audio settings all move
  to the same key.
- Settings persist on the `Source` row (six ALTER TABLE guards + SELECT/INSERT), so a keyed layer
  comes back keyed.
- Panel section is plain creator words: Green/Blue Screen, Amount, Softness, Fringe.

Test: `ChromaKeyApplyTests` — the pipe asks ffmpeg to key (and does not when off); a green-screen
clip is offered, accepting it starts a keyed session, the layer's resolver then reads that session
rather than the old one; the setting survives a save.

Docs: TASK 64 D/E ticked with slice F (auto-apply setting + alert clips) left open; frame-pipeline
records the decode-option design; HANDOFF rewritten. verify.sh: 544 passed, 0 failed, 0 warnings.

docs/ai/frame-pipeline.md

@@ -805,6 +805,13 @@ Full suite 290/291 passing, the sole failure the pre-existing compositor pixel t
   layer's Level/Mute per session and raises `AudioAvailable`, and `MainViewModel` feeds it to
   `AudioMixer.EnqueueDesktopMediaAudio` — the DESKTOP/GAME ring, so the desktop fader and the voice
   ducker apply. The alert clip keeps its own unity-gain ring (`EnqueueAlertAudio`, never ducked).
+  **Green/blue screen (TASK 64)** rides the same pipe as a decode option: `VideoFilterChain.BuildVideo`
+  appends `colorkey=…` + `despill=…` + `format=bgra` after the scale, so the key is computed by ffmpeg
+  and both consumers (shared preview bitmap, compositor frame) carry the same alpha — no app-side
+  per-pixel pass, no second render path. A media session is therefore keyed by **path + look**
+  (`MainViewModel.MediaSessionKey`), so two layers with identical settings share one decoder and two
+  different looks get two. The offer comes from `ChromaKeyDetector` over one probed frame
+  (`FfmpegChromaProbe`); settings persist on the `Source` row.
 - **Social bar on the output (bar bug-fix branch):** the `FramePump` takes an optional
   `socialBar: Func<(VideoFrame? Frame, SocialBarPosition Position)>?` seam, re-read **every frame** (so a
   mid-stream position flip applies immediately). The strip is pre-rasterized by `Compositor/SocialBarRenderer.cs`