Cap red eye corrections at 64 per photo (#2556)

Every output pixel goes through every eye, and nothing limited the list:
a sidecar, preset or agent with 100,000 eyes made one preview take hours.
The render resolves the first MAX_RED_EYES and redeye.add refuses more,
as Point Color does with MAX_POINT_COLORS.

crates/develop/src/settings.rs

@@ -134,6 +134,7 @@ pub struct DevelopSettings {
     pub orientation: Orientation,
     pub masks: Vec<Mask>,
     pub spots: Vec<Spot>,
+    /// Red eye corrections; the first [`MAX_RED_EYES`] render.
     pub red_eye: Vec<RedEye>,
     pub lens_blur: LensBlur,
     pub enhance: Enhance,
@@ -1069,6 +1070,10 @@ impl Default for Spot {
     }
 }
 
+/// Most red eye / pet eye corrections a photo renders. Every output pixel goes through every eye, so render cost is
+/// pixels x eyes; a sidecar, preset or agent with thousands could stall a render for hours (issue #2556).
+pub const MAX_RED_EYES: usize = 64;
+
 /// A red eye / pet eye correction: the user's ellipse (centre normalized, radii as fractions of
 /// the long edge); the pupil inside it is found automatically.
 #[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]