web: open a RAW at the resolution of its sensor, not at the quarter of it

LibRaw's half-size demosaic was on. The Ricoh GR's own DNG (D0004128.DNG)
developed to 3010x2012 while the JPEG written beside it in the same second is
6000x4000, and the Fuji's RAF to 3008x2007 against its own 6000x4000 -- the
quarter was the flag, not the file. With `halfSize: false` the same develop
returns 6020x4024 and it is the sensor's frame on every body tried:

  D0004128.DNG  6020x4024   IMGP6916.DNG        6028x4024
  DSCF1701.RAF  6016x4014   _DSC0009.ARW        6024x4024
  AFXT2721.RAF  6246x4170   Nikon-D850 NEF      6216x4136
  _GDN0447.NEF  4284x2844   P1010607.RW2        3472x3472
  5G4A9396.CR2  2880x1920

Nine files, 27s to 155s a develop on one core. Checked through the app
itself, not only through LibRaw: photo-dims 6020x4024 on the DNG against
6000x4000 on the JPEG, both err none.

The colour it opens with is now fitted per file to the preview the camera wrote
into it (previewMatch.ts): a 3x3 over a block grid of the develop against the
same grid of that preview, then one cubic a channel for what the 3x3 leaves.
The offline per-body table this replaces (cameraMatch.ts) stopped matching the
moment the path under it changed -- its rows no longer summed to 1 once the
highlight knee landed ahead of it -- and a body with a row opened with a cast
one without did not. The file's own preview does not age.

The white level the gain carries is the frame's own plateau rather than
`maximum` (sensorWhite.ts), a factor of 1.89 to 2.00 out; without it every
frame opened a stop bright and a body that sat lower (X-Trans, 1.892) never
reached the highlight desaturation at all.

The desaturation gate reads the gain-lifted levels as well as the sensor's,
which is the whole of the magenta: on a body whose cam_mul lifts red and blue
(the GR's [2.64, 1, 1.73]) a blown sky crosses the white level at 0.38 of the
raw range in red while green crosses at 1.0, so a gate read on the sensor's
levels alone stayed shut across it. Measured in the app against the camera's
own JPEG, mean dRGB over a 16x16 block grid: +1.20, -5.95, -6.11 with the
sensor's clip alone, +0.21, +0.24, +0.47 with both, mean |dL| 21.5 against
10.3. The same grid on the Fuji comes back balanced (+4.7, +5.0, +3.6) and best
aligned at offset 0,0.

-HL is recovery and +HL is a lift, so they are different moves now: recovery is
the doc's soft knee in linear light over the top half, which is the only term
in the tone shader that is not a shift and the only one that can put detail
back into a blown sky rather than merely darken it.

The four checks pin the develop down where it can only run in a browser:
raw-develop-check, preview-match-check, white-level-check, highlight-knee-check.

docker/frontend/shared/utils/toneShader.ts

@@ -14,18 +14,28 @@ import { HSL_BANDS, hslBandGaps, isMonochromeBase } from './colorUtils';
 // (a knee that started lower dragged a mid-grey down) while SH rides the lower
 // half (0.00..0.55), and the 0.50 midpoint never moves.
 //
-// HL is Lightroom's highlight RECOVERY and it is weighted by the headroom that is
-// left, (1 - t): the move falls to zero as t reaches pure white, so a blown sky,
-// a lamp or a specular can be pulled back without the white going grey. The pull
-// peaks around t = 0.79 at 0.13 of the ramp for a full -10 — the edge of a cloud,
-// which is the detail there is to get back (measured, and checked for
-// monotonicity over the whole -1..1 rectangle of the two knobs).
+// HL is two different controls with one knob, because recovery and a lift are
+// not the same move:
 //
-// Both knobs are additive shifts of the luma. That keeps the curve monotonic
-// (worst slope +0.003 at t = 0.99 with HL +10 and SH -10, and the two knees
-// barely overlap), so a brighter input can never come out darker. The earlier
-// multiplicative form was NOT monotonic: with hl=-1 a grey 0.73 came out
-// darker than 0.80.
+//  -HL is Lightroom's highlight RECOVERY: a soft knee in LINEAR light over the
+//  top half (T = 0.5), pulled down by the ratio of the new luma to the old (see
+//  the knee in TONE_SKSL). That is the shape the doc asks for, and the shape the
+//  encoded domain cannot give — on the encoded value the last stop of headroom
+//  is a few code values wide. It is the only term here that is not a shift, so
+//  it is also the only one that can put detail back into a blown sky rather than
+//  merely darken it. T=0.5 and S = |hl| keep it monotone (the slope leaves the
+//  knee at 1 and falls, never rises) and it never brightens, so the frame cannot
+//  invert.
+//
+// +HL is a LIFT, weighted by the headroom that is left, (1 - t): the move falls
+// to zero as t reaches pure white, so a lamp or a specular is not turned grey,
+// and it rides into the upper midtones where a lift is wanted. The pull peaks
+// around t = 0.79 at 0.13 of the ramp for a full +10.
+//
+// SH stays an additive shift. Shifts keep the curve monotonic (worst slope
+// +0.003 at t = 0.99 with HL +10 and SH -10, and the two knees barely overlap),
+// so a brighter input can never come out darker. The earlier multiplicative
+// form was NOT monotonic: with hl=-1 a grey 0.73 came out darker than 0.80.
 //
 // dr  - DR strength 0..1: lifts shadows slightly and rolls highlights
 //       (Fuji extended DR); 0/auto/DR100 = no extra curve.
@@ -137,9 +147,41 @@ float bandW(float hue, float anchor, float gapL, float gapR) {
   float d = mod(hue - anchor + 180.0, 360.0) - 180.0;
   return d <= 0.0 ? max(0.0, 1.0 + d / gapL) : max(0.0, 1.0 - d / gapR);
 }
+// The sRGB transfer pair, the accurate one (0.04045/12.92 + 2.4) — the same
+// constants colorUtils.planckianLinear uses on the WB side and EXPOSURE_SKSL
+// uses for its own pass. Highlight recovery needs the same space: a knee drawn
+// on the encoded value has the wrong shape (the midtones sit high and the last
+// stop of headroom is squeezed into a few code values), which is exactly the
+// doc's point about working in linear light.
+vec3 toLinear(vec3 c) {
+  return mix(c / 12.92, pow((c + 0.055) / 1.055, vec3(2.4)), step(vec3(0.04045), c));
+}
+vec3 toEncoded(vec3 c) {
+  return mix(c * 12.92, 1.055 * pow(c, vec3(1.0 / 2.4)) - 0.055, step(vec3(0.0031308), c));
+}
 vec4 main(vec2 xy) {
   vec4 c = src.eval(xy);
   vec3 rgb = clamp(c.rgb, 0.0, 1.0);
+  // HIGHLIGHT RECOVERY (-HL): the doc's soft knee, and it runs in LINEAR light,
+  // before the luma and the masks below are read, so every later stage sees the
+  // recovered value:
+  //   L' = L                                , L <  T
+  //   L' = T + (L - T) / (1 + 2 S (L - T))  , L >= T
+  // with T = 0.5 and S the knob. The pixel is rebuilt by the ratio L'/L, so
+  // every channel keeps its share of the light and the hue and the saturation
+  // cannot drift; the curve leaves T with the slope it arrived with (1), so
+  // there is no seam at the knee; and the knee never brightens (S = 1 puts the
+  // white point on 0.75), which is what a recovery slider has to do.
+  if (hl < 0.0) {
+    vec3 lin = toLinear(rgb);
+    float l0 = dot(lin, vec3(0.2126, 0.7152, 0.0722));
+    if (l0 > 0.5) {
+      float over = l0 - 0.5;
+      float S = min(-hl, 1.0);
+      lin *= (0.5 + over / (1.0 + S * over * 2.0)) / l0;
+      rgb = clamp(toEncoded(lin), 0.0, 1.0);
+    }
+  }
   float t = clamp(dot(rgb, vec3(0.2126, 0.7152, 0.0722)), 0.0, 1.0);
   float hlMask = smoothstep(0.50, 1.00, t);
   float shMask = 1.0 - smoothstep(0.00, 0.55, t);
@@ -149,7 +191,11 @@ vec4 main(vec2 xy) {
   // weight is 0, so the pull-back cannot touch a pure white (a sun, a bulb, a
   // specular) and cannot turn it grey. A LIFT gets the same weight, which rides
   // it into the upper midtones and leaves the clipping where it was.
-  float o = t + hl * hlMask * (1.0 - t) + sh * 0.34 * shMask;
+  // The LIFT only, so max(hl, 0): -HL has already been spent in linear light
+  // above, and running it through this additive term as well would double-count
+  // it (and, being an additive shift, would darken the white the knee just
+  // protected).
+  float o = t + max(hl, 0.0) * hlMask * (1.0 - t) + sh * 0.34 * shMask;
   // Dynamic range: gentle shadow lift + highlight roll (protect brights).
   o += dr * 0.12 * shMask * (1.0 - t);
   o -= dr * 0.18 * hlMask * t;