web: open a RAW at the resolution of its sensor, not at the quarter of it

LibRaw's half-size demosaic was on. The Ricoh GR's own DNG (D0004128.DNG)
developed to 3010x2012 while the JPEG written beside it in the same second is
6000x4000, and the Fuji's RAF to 3008x2007 against its own 6000x4000 -- the
quarter was the flag, not the file. With `halfSize: false` the same develop
returns 6020x4024 and it is the sensor's frame on every body tried:

  D0004128.DNG  6020x4024   IMGP6916.DNG        6028x4024
  DSCF1701.RAF  6016x4014   _DSC0009.ARW        6024x4024
  AFXT2721.RAF  6246x4170   Nikon-D850 NEF      6216x4136
  _GDN0447.NEF  4284x2844   P1010607.RW2        3472x3472
  5G4A9396.CR2  2880x1920

Nine files, 27s to 155s a develop on one core. Checked through the app
itself, not only through LibRaw: photo-dims 6020x4024 on the DNG against
6000x4000 on the JPEG, both err none.

The colour it opens with is now fitted per file to the preview the camera wrote
into it (previewMatch.ts): a 3x3 over a block grid of the develop against the
same grid of that preview, then one cubic a channel for what the 3x3 leaves.
The offline per-body table this replaces (cameraMatch.ts) stopped matching the
moment the path under it changed -- its rows no longer summed to 1 once the
highlight knee landed ahead of it -- and a body with a row opened with a cast
one without did not. The file's own preview does not age.

The white level the gain carries is the frame's own plateau rather than
`maximum` (sensorWhite.ts), a factor of 1.89 to 2.00 out; without it every
frame opened a stop bright and a body that sat lower (X-Trans, 1.892) never
reached the highlight desaturation at all.

The desaturation gate reads the gain-lifted levels as well as the sensor's,
which is the whole of the magenta: on a body whose cam_mul lifts red and blue
(the GR's [2.64, 1, 1.73]) a blown sky crosses the white level at 0.38 of the
raw range in red while green crosses at 1.0, so a gate read on the sensor's
levels alone stayed shut across it. Measured in the app against the camera's
own JPEG, mean dRGB over a 16x16 block grid: +1.20, -5.95, -6.11 with the
sensor's clip alone, +0.21, +0.24, +0.47 with both, mean |dL| 21.5 against
10.3. The same grid on the Fuji comes back balanced (+4.7, +5.0, +3.6) and best
aligned at offset 0,0.

-HL is recovery and +HL is a lift, so they are different moves now: recovery is
the doc's soft knee in linear light over the top half, which is the only term
in the tone shader that is not a shift and the only one that can put detail
back into a blown sky rather than merely darken it.

The four checks pin the develop down where it can only run in a browser:
raw-develop-check, preview-match-check, white-level-check, highlight-knee-check.

docker/frontend/src/engine/sensorWhite.ts

@@ -0,0 +1,54 @@
+// Where this frame's sensor actually ran out, in the plane's own counts.
+//
+// `maximum` is the format's full scale, not the sensor's: a frame that has blown
+// plateaus at 1.89-2.00x it (measured, as ratios of `maximum - black`: Sony
+// ILCE-5100 2.002, Ricoh GR III 1.964, Fuji X-T3 / X100V / X100S 1.892) and the
+// white level the shader divides by has to be that plateau, or the frame lands
+// short of white and the highlight desaturation — a smoothstep that starts at
+// 0.95 of the *sensor* — never fires on a body that sits at 0.946. Reading it
+// off the frame is what makes one develop right for every body.
+//
+// A plateau, not a max: the frame is read over the nine counts at its top, and
+// the white level is the highest of those that is a **cliff** — a count the one
+// below it does not come near. A clipped region piles at the level the sensor
+// stops at, so the count under that level is the sensor's own noise floor and
+// orders of magnitude smaller; a smooth bright sky hands its top count to the
+// next one down in similar numbers and is left alone. A frame that has not
+// clipped — and one that never reaches the format's own scale — stays on the old
+// factor two, the population mean of the ratios above and the best guess when
+// there is nothing to measure.
+//
+// One count down, not the largest of the three: a sensor clips its channels at
+// counts a couple apart, so the plane carries a second pile just under the top
+// one, and asking the top pile to beat *that* pile refused every frame whose
+// channels do not run out together. Measured on a Fujifilm XF10 RAF: 433819
+// samples at 30993 over 30 at 30992 — a cliff — and 83954 at 30990 three counts
+// under it, which the old rule read as the ground the top pile had to clear eight
+// times over (it clears 44, not 83954) and answered "not clipped" for a frame
+// holding 6.7% of its plane at the level. Read that way the develop divided by
+// 2.000x instead of 1.953x, its plateau landed on 0.976 of the sensor, the
+// desaturation fired at half strength, and the highlights kept the magenta the
+// white balance gains make of them (36.7% of the frame's bright blocks red and
+// blue of green against 0.0% in the camera's own JPEG of the same shot).
+//
+// The pile is still asked to be a few dozen samples and not a share of the plane:
+// what a blown region is has nothing to do with how many the plane holds, and the
+// frame that has blown one lamp is the frame whose highlights need the level most.
+export function sensorWhite(data: ArrayLike<number>, maximum: number, black: number): number {
+  const legacy = 2 * (maximum - black);
+  const n = data.length;
+  let top = 0;
+  for (let i = 0; i < n; i++) if (data[i] > top) top = data[i];
+  if (top < maximum - black) return legacy;
+  const lo = top - 8;
+  const near = new Uint32Array(9);
+  for (let i = 0; i < n; i++) { const v = data[i]; if (v >= lo) near[v - lo]++; }
+  const floor = Math.max(32, Math.ceil(n * 1e-6));
+  // The top count can be a stray sample above the sensor's level; the pile under
+  // it is the level itself, so the scan starts at the top and takes the first
+  // count that is both a pile and a cliff over the count below it.
+  for (let k = 8; k >= 1; k--) {
+    if (near[k] >= floor && near[k] >= near[k - 1] * 8) return lo + k;
+  }
+  return legacy;
+}