feat(#1520): Selfie generative background + cartoonify (client-side)

[jung-thomas]

Selfie Tier 3 (#1520) — client-side generative background + cartoonify

Adds two 100% client-side capabilities to the Devtoberfest selfie composer (/devtoberfest/selfie/), preserving the hard privacy promise — your photo never leaves the browser. No hosted inference, no photo egress; the only new network activity is loading same-origin assets (themed background PNGs + the ONNX model + onnxruntime-web's own bundled WASM).

What's new

• Themed background swap — pick a scene (Terminal, Starfield, TechEd Stage, Pumpkin Patch, Autumn Gradient) rendered on a new bottom-most Konva layer behind the cut-out person. Picking a scene forces removeBg on (a themed background is meaningless without the cutout). Vector art generated at build time (SVG→PNG via sharp).
• Cartoonify — a neural style-transfer effect (AnimeGANv2 face_paint_512_v2, ONNX, run in-browser via onnxruntime-web). New async effect path; the model + runtime are lazy-imported so neither touches the page-load path.

Architecture (Approach A — two independent bounded layers)

• backgrounds.ts — scene definitions + backgroundUrl helper.
• compose.ts — setBackground(img|null) on a bottom-most bgLayer; exportPng now awaits the async effect dispatcher (effect bakes before the polaroid border).
• stylize.ts — cartoonify(canvas); fail-soft (any failure returns the input canvas unchanged); a load failure clears the cached session so a later attempt can retry.
• effects.ts — 'cartoon' effect id + applyEffectAsync (routes cartoon → cartoonify, delegates all other ids to sync applyEffect).
• BackgroundPicker.vue + Composer.vue wiring (scene picker, cartoon busy spinner, Export disabled during bake).

Licensing

The AnimeGANv2 model binary ships with a verbatim MIT LICENSE (© 2021 Bryan Lee) + ATTRIBUTION.md (source URL, SHA-256, provenance) under hugo/static/vendor/animegan/. Vendored via scripts/vendor-animegan.mjs (idempotent, SHA-guarded, sentinel-tracked).

Testing

• 139/139 selfie unit tests pass; vite build clean (onnxruntime-web lazy-splits into its own chunk).
• Built via subagent-driven-development: fresh implementer per task + task review after each + a broad opus whole-branch review (clean — no Critical/Important findings).

Not covered / follow-up

• Live browser QA at /devtoberfest/selfie/ is the post-merge step — the onnxruntime-web WASM resolution under the approuter CSP can only be confirmed in a real browser (unit tests mock ORT). The imgly precedent (fix(selfie): attach camera after DOM mount; scope 'unsafe-eval' CSP to /devtoberfest/* #1546) already proved the CSP permits 'wasm-unsafe-eval' + 'unsafe-eval'.
• Cartoon output is opaque (alpha=255) — the niche borderless+background-less cartoon case loses composite transparency (in-design: the effect applies to the whole composite).

🤖 Generated with Claude Code