feat(booth): close the keep round trip, and add cosmetic per-item blur

Two operator requests.

KEEP, BOTH DIRECTIONS. The kept lane could already release a booth back to
ephemeral, but an ephemeral booth could only be promoted from a shell -- so the
round trip was closed only if you had ssh. The /keep route and the `booth keep`
verb both already existed; only the button was missing. Adds ★ to the ephemeral
card, mirroring × on the other shoulder.

BLUR. Per-item cosmetic censoring: `booth blur <name> <file>...`, a ◌/◉ toggle
in each caption row, and 👁 click-to-reveal. State is `.blurred` in the booth
dir, one booth-relative path per line -- the same filesystem-is-the-state idiom
as .pins and .forever. An empty set deletes the marker rather than leaving a
zero-byte file, so `ls -a` tells the truth.

⚠ BLUR IS NOT ACCESS CONTROL, and the code, the docs and a test all say so on
purpose. A blurred item is still served at its own URL, still in the zip, still
on disk. The Booth has no auth by design. test_blur_is_cosmetic_the_file_is_
still_served asserts the 200 deliberately: if someone later "hardens" this into
a 403 that test fails, and it should, because half-implemented access control is
more dangerous than none.

Reveal is per-viewer and never persisted; a reload re-hides. With JS off an item
stays blurred, which is the safe direction to fail in.

Two things the first pass got wrong, both caught by checking rather than
assuming:

  * The cover thumb. index.html has IDENTICAL markup in the kept and ephemeral
    lanes, so a single-occurrence replace patched only the kept one and the
    ephemeral front page happily displayed the thing someone had hidden. The
    test that caught it was itself wrong first -- it matched the bare string
    "blurred-thumb", which is in base.html's stylesheet on every page and so
    passed in both states. It now asserts the attribute.
  * Inline docs render through their own <figure> branch and were left
    unblurred -- the branch that puts readable text straight on the page, so it
    needed blur more than images do. The suite passed; a live curl caught it.

165 tests pass (154 pre-existing, unchanged).

scripts/booth

@@ -63,10 +63,11 @@ set -euo pipefail
 DATA="${BOOTH_DATA_DIR:-$HOME/booth-data}"
 URL="${BOOTH_URL:-http://10.100.10.50:8090}"
 KEEP=".forever"                                    # must match KEEP_MARKER in booth/app.py
+BLUR=".blurred"   # one booth-relative item path per line; see `blur` below
 LINKS_BOARD="${BOOTH_LINKS_BOARD:-links}"
 
 usage() {
-  echo "usage: booth {new <name>|add <name> <file>...|url <name>|ls|rm <name>|keep <name>|unkeep <name>|link <url> [description]|links|unlink <id|index>|ask <name> <stem> <prompt> <option>... [--no-notes]|asks <name>|answer <name> <stem> [--wait [SECS]]}" >&2
+  echo "usage: booth {new <name>|add <name> <file>...|url <name>|ls|rm <name>|keep <name>|unkeep <name>|blur <name> <file>...|unblur <name> <file>...|link <url> [description]|links|unlink <id|index>|ask <name> <stem> <prompt> <option>... [--no-notes]|asks <name>|answer <name> <stem> [--wait [SECS]]}" >&2
   exit 2
 }
 
@@ -117,6 +118,39 @@ case "$cmd" in
     rm -f -- "$DATA/$1/$KEEP"
     echo "unkept — $1 rejoins the 24h sweep"
     ;;
+  blur|unblur)
+    # ⚠ COSMETIC ONLY. A blurred item is still served at its own URL, still in
+    # the zip, still on disk. This hides it from a glance — a shoulder, a
+    # screen-share, a scroll past something you did not want full-size. The
+    # Booth has no auth by design: if a thing must not be SEEN, it must not be
+    # in a booth.
+    [ $# -ge 2 ] || usage
+    b="$1"; shift
+    [ -d "$DATA/$b" ] || { echo "no such booth: $b" >&2; exit 1; }
+    f="$DATA/$b/$BLUR"
+    for item in "$@"; do
+      item="${item#"$DATA/$b/"}"; item="${item#/}"
+      case "$item" in
+        *..*) echo "refusing path with '..': $item" >&2; exit 2 ;;
+      esac
+      [ -e "$DATA/$b/$item" ] || echo "warning: no such item in $b: $item" >&2
+      touch "$f"
+      if [ "$cmd" = blur ]; then
+        grep -qxF -- "$item" "$f" || printf '%s\n' "$item" >> "$f"
+      else
+        grep -vxF -- "$item" "$f" > "$f.tmp" || true
+        mv -- "$f.tmp" "$f"
+      fi
+    done
+    # An empty marker is a lie by omission — `ls -a` should say whether
+    # anything here is blurred at all.
+    [ -s "$f" ] || rm -f -- "$f"
+    if [ "$cmd" = blur ]; then
+      echo "blurred (cosmetic — still served): $URL/b/$b/"
+    else
+      echo "un-blurred: $URL/b/$b/"
+    fi
+    ;;
   link)
     [ $# -ge 1 ] || usage
     link_url="$1"; shift