Let a photograph leave: an export button, and a cache to leave from

dr-export could turn a frame into bytes and nothing could ask it to. This is
the button, and the place the bytes go.

**Everything is staged first.** An export bound for the server is written to a
local outbox and uploaded afterwards; offline is not a special case, it is the
same path with a drain that finds the server absent. Doing it the other way —
upload directly, stage only on failure — makes the failure path the one that
is rarely exercised and always broken, and a network drop mid-batch leaves
some exports existing and some not with nothing recording which. Staged first,
an export is finished the moment it is written and the upload is a promise
kept later.

The outbox sits beside the catalog rather than under the cache. dr_catalog's
cache already draws that line: passive entries are a convenience and go under
LRU, pinned ones are a promise and never do. An export awaiting upload is a
promise — the user was told it succeeded — and sweeping it for disk would
destroy the only copy. Bytes are written before the destination record, so a
kill between the two leaves an orphan the drain ignores rather than a record
pointing at nothing.

The status line says "Queued for Exports/2026", never "Exported to Nextcloud",
until it has actually landed. There is a test asserting that wording, because
the tempting shorter sentence is a claim the app cannot keep.

The drain runs on the sync pass, before the shards: a thumbnail shard can be
rebuilt from the originals and the catalog is an index, but a queued export
exists nowhere else.

`DevelopSession::render_for_export` renders the framed size rather than reusing
the frame on screen, which is deliberately viewport-sized (FR-DSP-1) — encoding
that would hand the user a soft, screen-sized file with nothing to say anything
had been lost (FR-EXP-9).

One compromise, recorded rather than hidden: the export runs synchronously on
the UI thread, so the window is unresponsive for the few hundred milliseconds
a full-resolution render and encode takes. Moving a DevelopSession and its GPU
pass to a worker is a larger change than one button earns, and it is batch
export that makes the wait intolerable rather than merely noticeable.

Still missing: the Nextcloud folder *picker*. The destination is typed into
Settings for now. `FolderBrowser` in launch.rs is already the reusable model
for it — it browses a remote tree and nothing about it is specific to choosing
a library root — but wiring it into the settings page needs a listing worker
and browser UI there, which is its own piece of work.

Carries in-flight work from a parallel session — presets, the develop copy and
paste, and the node schema's `presentation` and `enum` support. One misplaced
callback in settings_ui.rs is moved from `render` to `wire`: registered in
`render` it borrowed a `&SettingsController` into a 'static closure and would
not compile, and that file's own docs say render pushes properties while wire
connects callbacks.

992 tests pass, clippy and fmt clean. Traceability 48.3% -> 51.0%.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui/dr-ui/src/settings_ui.rs

@@ -109,6 +109,7 @@ pub fn render(window: &AppWindow, controller: &SettingsController) {
     window.set_settings_thumbnail_budget(budget::label(s.cache.thumbnail_budget_bytes).into());
     window.set_settings_thumbnail_unlimited(s.cache.thumbnail_budget_bytes.is_none());
     window.set_settings_keep_opened(s.cache.keep_opened_originals);
+    window.set_settings_copy_includes_framing(s.develop.copy_includes_framing);
     window.set_settings_cache_usage(controller.usage_label.borrow().clone().into());
 
     // --- export --------------------------------------------------------
@@ -430,6 +431,20 @@ where
         });
     }
 
+    // TRACES: FR-DEV-6
+    // Whether a copied edit carries the crop. Off by default — see
+    // `DevelopSettings::copy_includes_framing` for why that is the safe
+    // direction rather than merely the conservative one.
+    {
+        let weak = window.as_weak();
+        let ctl = controller.clone();
+        window.on_settings_copy_includes_framing_toggled(move |on| {
+            let Some(w) = weak.upgrade() else { return };
+            ctl.edit(|s| s.develop.copy_includes_framing = on);
+            render(&w, &ctl);
+        });
+    }
+
     {
         let weak = window.as_weak();
         let ctl = controller.clone();