Show the photograph the way it was taken

Nothing read EXIF orientation, so every frame from a body held sideways
lay on its side — in the grid, in develop, and in the read-only preview.

The tag is honoured as part of *reading the file*, at the same standing
as a RAW's masked-photosite crop, never as an edit. It lives as a
baseline on Framing rather than as a starting value for quarter_turns,
which is what keeps four things true: a sideways file opens unmodified,
reset returns it to upright rather than to the sensor's scan order, its
sidecar stays empty, and the rotate button still moves the image 90°
whatever the file underneath it says.

Framing::effective composes the baseline with the user's own turns
through the group law rather than by adding turns and OR-ing flags. The
naive version gets one case wrong — an odd baseline turn plus a user
mirror — and gets it wrong quietly, because the result is still a
plausible orientation. The composition collapses to a single
permutation, so obeying the tag costs nothing per pixel.

dr_decode::orientation is a header-only IFD walk, separate from
metadata() for the reason the entry points are separate at all: the grid
asks once per cell and must not build a rawler decoder to get one tag.
CR3 and RAF fall back to the full read, being neither TIFF nor JPEG.

Written down as FR-DEV-3h.

Known gap: thumbnails cached before this stay sideways. The store is
keyed by file and size, and its shards sync — invalidating them would
have every client re-download 25 MB a shard, which is not this commit's
call to make.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui/dr-ui/src/develop.rs

@@ -28,10 +28,19 @@ pub struct DevelopSession {
 
 impl DevelopSession {
     /// Demosaic an image and prepare its edit graph.
-    pub fn open(ctx: &GpuContext, raw: &RawImage) -> Result<Self, String> {
+    ///
+    /// `orientation` is the file's EXIF orientation, not an edit: a sensor is
+    /// scanned the same way whichever way the body was held, so this is what
+    /// makes a portrait frame open upright. It is fixed for the life of the
+    /// session and survives a reset.
+    pub fn open(
+        ctx: &GpuContext,
+        raw: &RawImage,
+        orientation: dr_types::Orientation,
+    ) -> Result<Self, String> {
         let demosaicer = Demosaicer::new(ctx).map_err(|e| e.to_string())?;
         let demosaiced = demosaicer.run(raw).map_err(|e| e.to_string())?;
-        Ok(Self::with_source(ctx, demosaiced))
+        Ok(Self::with_source(ctx, demosaiced, orientation))
     }
 
     /// Prepare an edit graph over an already-processed RGB image.
@@ -49,15 +58,22 @@ impl DevelopSession {
         rgba: &[u8],
         width: u32,
         height: u32,
+        orientation: dr_types::Orientation,
     ) -> Result<Self, String> {
         let source =
             DemosaicedImage::from_rgba8(ctx, rgba, width, height).map_err(|e| e.to_string())?;
-        Ok(Self::with_source(ctx, source))
+        Ok(Self::with_source(ctx, source, orientation))
     }
 
-    fn with_source(ctx: &GpuContext, demosaiced: DemosaicedImage) -> Self {
+    fn with_source(
+        ctx: &GpuContext,
+        demosaiced: DemosaicedImage,
+        orientation: dr_types::Orientation,
+    ) -> Self {
+        let mut graph = EditGraph::default_chain();
+        graph.set_orientation(orientation);
         Self {
-            graph: EditGraph::default_chain(),
+            graph,
             demosaiced,
             adjust: AdjustPass::new(ctx),
         }
@@ -751,7 +767,9 @@ mod tests {
                 rgba.extend_from_slice(&[(x * 4) as u8, (y * 4) as u8, 128, 255]);
             }
         }
-        let mut session = DevelopSession::open_rgb(&ctx, &rgba, w, h).expect("session");
+        let mut session =
+            DevelopSession::open_rgb(&ctx, &rgba, w, h, dr_types::Orientation::NORMAL)
+                .expect("session");
 
         let fitted = session.render(64, 64).expect("fitted render");
         session.zoom_about(4.0, 0.5, 0.5);
@@ -789,7 +807,9 @@ mod tests {
         // Bigger than the viewport it is shown in: `fit` scales it down, so
         // every screen pixel still has several source pixels behind it.
         let big = vec![128u8; (800 * 800 * 4) as usize];
-        let mut session = DevelopSession::open_rgb(&ctx, &big, 800, 800).expect("session");
+        let mut session =
+            DevelopSession::open_rgb(&ctx, &big, 800, 800, dr_types::Orientation::NORMAL)
+                .expect("session");
         assert!(
             !session.magnifies_source(200, 200),
             "a downscaled image is not magnified"
@@ -808,7 +828,9 @@ mod tests {
         // Smaller than the viewport: `fit` refuses to upscale, so the render is
         // 1:1 and unzoomed is exactly the boundary — not past it.
         let small = vec![128u8; (100 * 100 * 4) as usize];
-        let mut session = DevelopSession::open_rgb(&ctx, &small, 100, 100).expect("session");
+        let mut session =
+            DevelopSession::open_rgb(&ctx, &small, 100, 100, dr_types::Orientation::NORMAL)
+                .expect("session");
         assert!(
             !session.magnifies_source(800, 800),
             "1:1 is the boundary, not past it — filtering must not flip on a \