feat: HDR — single-capture local tone mapping (multi-scale exposure fusion)

[sayed3li97]

What

Adds HDR exposure fusion — CameraProController.captureHdr({stops}) captures an EV bracket and merges the frames into one tone-mapped image using single-scale Mertens exposure fusion. This completes the pro-capture pillar: burst → bracket → HDR. It's pure engineering (no hardware gate) and works on every platform that has the digital pipeline (macOS/iOS + web).

How

• C core (src/core/image_processor.c): camera_pro_exposure_fusion — per pixel, weight each exposure by well-exposedness (a Gaussian around mid-grey) × saturation, normalise across the bracket, blend. Math in double; new clampd_u8.
• Parity: byte-for-byte pure-Dart port in native_core_web.dart; the FFI/browser tests cross-check the two within 1 LSB.
• API: captureHdr() drives the EV loop, grabs frames, and delegates fuse+encode to the backend's new fuseExposures (Apple → PNG on disk, web → RGBA bytes, stub → typed error). capabilities.supportsHdr flipped true; an HDR button added to both example apps.

Live verification

Run on the real FaceTime HD camera in a dark room:

	mean luma	shadow<16
Single mid-EV frame	9.2	77.0% crushed black
HDR fused (−2/0/+2)	94.1	0.0%

The subject — invisible in the single exposure — is fully recovered in the fusion (shadows pulled from the +2 EV frame).

Verification summary

• C harness test_exposure_fusion (shadow lift, highlight recovery, n=1 identity, param validation) → 70 checks, arm64 + x86_64/Rosetta.
• 89 VM + 70 browser tests pass, including C-vs-Dart 1-LSB cross-check, colored-bracket channel-order pin, and size-mismatch rejection.
• dart analyze clean; dart pub publish --dry-run clean (384 KB).

Hardening from an adversarial-review pass

A multi-agent review of this diff surfaced (and this PR fixes) three real edge cases in the new code:

1. Geometry guard — captureHdr now rejects a bracket whose frames changed resolution mid-capture (e.g. a mobile-web orientation flip) with a typed CameraCaptureError instead of a RangeError/corrupt image.
2. Guarded exposure-restore — the finally restore is now best-effort (try/catch) in both captureHdr and captureExposureBracket, so a restore failure can't mask the real capture error or wedge the state machine in capturing.
3. Length validation in exposureFusion (native + web).

Note on release

Version stays at 0.0.2 (change logged under ## [Unreleased]), so merging does not auto-publish — release.yml skips because tag v0.0.2 already exists. Bump pubspec.yaml to 0.0.3 in a follow-up to cut the release.

🤖 Generated with Claude Code

[sayed3li97]

Reworked: HDR is now sharp and usable

The first cut produced ghosted, washed-out results. Root causes and fixes:

Problem	Cause	Fix
Ghosting / blur	3-frame temporal EV bracket ~360 ms apart → motion smears the average	Capture one frame and synthesize the exposure stack from it (gain = 2^ev in linear light) — ghost-free
Washed-out / hazy	naive single-scale weighted average	Proper multi-scale Mertens: contrast × saturation × well-exposedness weights blended through a Laplacian pyramid
Lost detail	no contrast weight	added contrast = |Laplacian(luma)|

This is single-image exposure fusion = local tone mapping (Wronski, Hessel WACV'20).

Verified live on the FaceTime HD camera: the tone-mapped still is pixel-sharp (ghosting gone) and natural — shadows opened, highlights held, local contrast preserved.

Verification: 78 C-harness checks (arm64 + x86_64/Rosetta), clean under AddressSanitizer + UBSan (the pyramid code does manual malloc), 90 VM + 71 browser tests, C-vs-Dart cross-check. All 4 CI jobs green. Also fixed an OOM-path pyramid leak found in a manual review pass.

API: backend fuseExposures → renderHdr(frame, {stops}); controller.captureHdr is now a single grab.