Protect selected windows from screen capture

Add capture privacy rules for windows, transient children, overview previews and client cursors, with separate capture rendering and deferred-frame invalidation. Keep detached close snapshots out of captures after clients leave the registry.

Validated with release workspace tests, private compositor/EGL regressions, and an isolated release PipeWire capture test.

docs/configuration.md

@@ -533,6 +533,24 @@ window rules can override that behavior.
 | `floating` | boolean | Leave placement unchanged |
 | `width`, `height` | numbers > 0 | Application-chosen floating size |
 | `fullscreen` | boolean | Leave fullscreen state unchanged |
+| `block-out-from-screencasts` | boolean | Exclude from captures; enabled by default for Ferese authentication dialogs |
+
+`window-rule app-id="org.example.Private" block-out-from-screencasts=#true`
+keeps matching windows visible on the display but omits them (including their
+popups, subsurfaces, shadows and overview previews) from monitor and region
+captures. The background or windows behind them remain visible in the capture.
+Transient children inherit protection even on another output. Direct window
+capture fails, ending an active window stream. Custom cursors from a client with
+a protected window are also omitted until the cursor image is replaced.
+Detached close-animation snapshots are omitted from captures.
+
+This applies to portal sharing, recording, native capture protocols and screenshots:
+these routes share capture buffers. The rule is checked against current app-ID,
+title and parent metadata, and updates on config reload. Other placement rules
+retain their existing lifecycle. Later matching rules may set the field to `#false`,
+including for `dev.ferese.Authentication`; a protected parent still protects its
+children. A protection change cancels deferred screenshots and window frames.
+Frames already delivered to a capture client cannot be recalled.
 
 Every rule needs at least one matcher, and supplied matchers must all match.
 Rules apply in order; later fields override earlier ones. Dimensions imply

docs/development.md

@@ -72,6 +72,17 @@ Encoding needs the recorder's GStreamer plugins. The transport test needs libei
 and uses synthetic input over a private socket pair. Hardware pointer barriers,
 multiple monitors, display sleep, and live authentication still need session tests.
 
+## Capture privacy checks
+
+The capture privacy regression uses disposable Wayland clients and offscreen EGL
+(including software Mesa); it does not capture the host desktop or validate DRM:
+
+```sh
+cargo test --locked -p ferese capture_privacy_pixels_and_policy_transitions -- --ignored
+cargo test --locked -p ferese backends::direct::capture::tests -- --ignored
+cargo test --locked -p ferese mirrored_pixels_fit -- --ignored
+```
+
 ## Report a bug
 
 Include the commit or installed release, reproduction steps, backend (nested or