fix(paint): unbreak shadows, bound the opacity layer, make the banding fix real - #154

…g fix real (#154)

Seven confirmed audit findings in the paint pass, plus one regression guard
for a side effect the scroll-wrap fix would otherwise have introduced.

- `overflow: hidden` erased the node's own outset `box-shadow`: the clip
  was installed before the shadow was drawn, so the shadow was clipped away
  by the very box it was supposed to sit outside.
- `backdrop-filter` was neutralised whenever `opacity < 1` on the same node.
- The opacity `save_layer` was allocated with no bounds — one full-viewport
  layer per node. On a 60-frame scenario this dominated everything else:
  42-60s down to 0.5s.
- Leaf painters were handed the border-box origin with the padding insets
  zeroed, so every leaf ignored `padding`. `Codeblock` stays a deliberate,
  now-documented exception: it reads `style.padding` itself and paints its
  own background from the border box, so honouring the general contract for
  it too would double-apply padding.
- Transform percentages were resolved against `max(width, height)` on both
  axes instead of per-axis.
- Scrolling tiled backgrounds walked out of frame: the offset grew linearly
  with time forever while the draw loops only overscan by one tile, so the
  pattern left a growing blank band. The offset now wraps into one tile
  period, and `draw_bg_grid_dots`'s x-loop overscans symmetrically like its
  y-loop already did (it started at 0, with no left margin).
- Both documented gradient banding mitigations were inert. The render
  surfaces are created with no Skia `ColorSpace`, which short-circuits the
  conversion, so tagging the shader's colors with `srgb_linear` was a
  silent no-op — and subdividing an already-sRGB lerp is a mathematical
  identity (17x the stops, zero visual effect). `subdivide_gradient_stops`
  now does the gamma round-trip itself on plain `f32`s, which works whatever
  color space the destination surface ends up carrying.

The wrap above needed one companion fix, found while verifying it rather
than reported: geometry is periodic on `spacing` and survives a wrap, but
the dot pulse is a `sin` of position and is not. Fed canvas-local
coordinates, every dot's radius and alpha stepped at once, every
`spacing / speed` seconds. The pulse now reads the unwrapped scroll track,
and the test asserting this also asserts that the naive version still
steps — so it cannot quietly become vacuous.

Tests: 153 + 117 + 6 + 3 + 5 + 215 + 3 pass on this branch alone.