Feat: Add optional three-channel sensor bloom model

Add an opt-in, post-processing limited-response model applied to the
finished linear HDR before tone mapping. Each RGB channel is processed
independently and isotropically: overflow above E spreads to the eight
neighbours with a fixed 9-point stencil, while the rest is absorbed or
lost at the image boundary. The synchronous ping-pong update uses a
monotonic bounding box and a row-parallel, deterministic reduction; the
conservative round bound reserves fp guard rounds inside a 4096 hard
limit and fails before touching HDR when exceeded.

Expose --sensor-bloom-limit E and --sensor-bloom-transfer e (both
required together, default disabled), validate them before expensive
initialization, and route every output path through the same hook in
write_frame_outputs: raw FITS first, bloom, tone-mapped PNG/PPM, then the
mesh overlay. The raw --hdr-output FITS therefore stays pre-bloom.

Add a standalone unit test (stencil, boundary loss, cascade reference,
symmetry, thread determinism, convergence limits, validation, allocation
failure), CLI integration and regression coverage, an isolated
sensor-bloom-bench target, and document the model in the design, usage,
README, and build docs.

README.md

@@ -138,8 +138,10 @@ be configured for the desired image accuracy; it is disabled by default.
 Tone-mapped PNG/PPM output uses a per-channel soft-clip display transform by
 default (`--tone-map softclip --tone-map-p 2`); `--tone-map reinhard` restores
 the historical curve used by the reference images above. The linear HDR FITS
-output never applies it. See [tone mapping and
-display](usage.md#tone-mapping-and-display).
+output never applies it. An optional limited-response sensor bloom
+(`--sensor-bloom-limit E --sensor-bloom-transfer e`, default disabled) can be
+applied to the linear HDR before display; it never changes the FITS output. See
+[tone mapping and display](usage.md#tone-mapping-and-display).
 Camera controls, movie sequences, lens-map reuse, PSF settings, and HDR output
 are described in [usage.md](usage.md). For fast single-frame previews,
 `--fast-mode` replaces per-event PSF splats with a supersampled delta deposit