fix: close the adversarial findings on the save/paste wave

Ported from da950460 (#1717).

In-place save:
- A stale retained handle could receive bytes serialized for a
  DIFFERENT format (Save As .dwg->.dxf whose re-pick failed wrote DXF
  bytes through the .dwg handle) or silently save in place while the
  user was told a copy was downloading. The serialized format now
  travels to completion (tab-keyed pending map), the write requires a
  matching handle extension AND a live tab, and a failed re-pick
  drops the old handle before the download fallback.
- Discarding an unsaved tab leaked its handle, and a serialization
  still in flight could then overwrite the real file the user just
  declined to save. Discard drops the handle; a tab-gone completion
  downloads instead of writing.
- Overlapping saves had no guard: a wasm in-flight slot refuses a
  second save with the same localized message, cleared on every exit
  path.

Paste: pasted_image_name built its timestamp from Date::new(0) — a
CONSTANT name, so every paste overwrote every earlier paste's image.
Real clock, milliseconds, and a collision-suffixed unique name now.

Capture: a web capture in a hidden tab, or one with nothing redrawing,
could hold the automation slot forever. It fails fast when the page is
hidden and gives up after 5 s, on main's frame-parked capture.

The XREF manager reports registry-loaded xrefs with their size on the
web instead of NotFound.

Left out: the always-warm print snapshot (a frames subscription that
emits a message on every frame keeps the app redrawing at the display
rate), so the browser-menu print wiring from the previous commit goes
too — its beforeprint readback printed blank pages on WebGL2. The
merge-residue hunks (re-added XREF bind tests, snap endpoint map and
3D-snap gate) belong to code main already has in its own form.

(cherry picked from commit da950460)

src/scene/model/image_model.rs

@@ -574,6 +574,18 @@ pub fn register_source(path: &str, bytes: Arc<Vec<u8>>) {
     }
 }
 
+/// Is a source registered under exactly this reference? The web paste path
+/// uses it to keep its generated `pasted-…` names unique: the registry is
+/// last-wins, so a reused name would silently re-point every earlier paste's
+/// entity at the newest pixels. Exact key match — generated names embed their
+/// own extension and are all lower-case digits.
+pub fn has_source(path: &str) -> bool {
+    source_cache()
+        .lock()
+        .unwrap_or_else(|error| error.into_inner())
+        .contains_key(path)
+}
+
 /// Every reference with bytes currently registered (picked or dropped).
 /// Used after a web open settles to catch images registered while the load —
 /// which builds the raster models — was already running.