Harden load safety and validation

[JesseRaber]

What changed

• unified pose preferences in a shared safety module and corrected Tuning pointers
• made Manual Layout use the active V2 validator and stop on unsafe pinned seeds
• prohibited real cabinets from falling back face-up onto the floor
• corrected the 85% rule to measure coverage of the door bank
• rejected cabinets that cannot pass through the configured rear opening
• added optional cabinet weights and trailer GVWR/GAWR/tongue inputs with a cargo moment calculation and print blocking when configured limits fail
• validated persisted/imported geometry and capped imports at 50 MB / 2,000 items
• escaped imported/user text before HTML, SVG, tuning, 3D-plan, and print rendering
• vendored pinned browser dependencies for deterministic offline/NAS use
• disposed replaced Three.js resources to prevent repeated-redraw GPU leaks
• added Node regression tests for safety helpers, critical source invariants, local dependencies, and application syntax

Why

The previous runtime had rule drift between the inline fallback engine, V2, Manual Layout, and Tuning. Manual pins could bypass V2 restraint and door-bank rules, documented door coverage was calculated against the wrong footprint, and some geometrically impossible or unsafe loads could still reach a printable plan.

User impact

Unsafe manual pins are refused with an explanation. Weight compliance is shown only when every required weight/rating is present; otherwise plans stay visibly marked unvalidated. Fully configured loads that exceed GVWR, axle, tongue, or positive-tongue requirements cannot be printed.

Validation

• npm test — 7/7 passing
• syntax validation for all first-party scripts and vendored JavaScript
• git diff --check
• local static-server smoke test: app, safety module, manual/V2 scripts, Three.js, and sql.js WASM all returned HTTP 200

Rendered browser automation was not available in the current Codex task, so interactive drag/3D/print QA should be completed before marking ready.