feat: hatch PDF draw order (#1345), numeric CAS (#1348), web automation (#1349), DATALINK table, System theme; honest decode accounting

Upstream issues, fixed:

#1345 — hatches plotted at draw_depth 0.0: the plot path cloned models
from the hatch cache, which bakes the depth at seed time; the canvas
re-reads the live depth map every frame, which is why the editor was
right and every export (PDF and native printing — both route through
the exporter) was wrong, with hatch-vs-hatch ties broken by HashMap
order. The plot path now re-reads the depth map per entity, and the
exporter's tie-break ranks follow the editor's own pass order
(hatch < image < wire fill < wire < text < wipeout) instead of pinning
hatches between fills and wires. Pinned by content-stream operator-
order tests (back/front hatches, overlapping hatches, interleaved
wire-between-hatches) and a scene test that fails pre-fix.

#1348 — set_properties' optimistic-concurrency compare now matches
numbers by value (10.0 == 10) through json_values_match, compatible
with the shape of upstream PR #1350; nested objects/arrays recurse.

#1349 — web automation contract: control protocol 2 (v1 clients still
accepted) adds {op:'open', name, data_base64} routed through the
guarded open queue; window.ocsControl.ready/request promise wrapper
with an ocs-ready event (web/ocs-control.js); the startup donation
prompt is suppressed once a control request is seen (opt-in pre-boot
via localStorage); docs/automation documents the whole web contract.

Also: DATALINK CSV-to-table works on web (picker + bytes through the
session registry — was std::fs, silently dead); COLORSCHEME accepts
System (prefers-color-scheme on web, AppsUseLightTheme on Windows).

Decode accounting, made honest per the fix-of-fix review: into_rgba8
allocates the RGBA destination while the native buffer is alive for
every non-Rgba8 layout (L8 5, La8 6, Rgb8 7, L16 6, La16 8 B/px
peaks — the formula now says so), GIF bills the screen+frame
coexistence at 8 B/px, and TIFF drops the 3x multipliers both ways —
tiff 0.11 splits the given budget between frame and scratch (a total
ceiling), so the old double-billing refused honest 16-bit GeoTIFFs
~2.25x early while admitting hostile chunk transients at 3x. The
image-refusal-unknown-size locale key moves to the group the catalog
always claimed (file).

src/app/mod.rs

@@ -2411,6 +2411,11 @@ pub enum Message {
     /// `None` = cancelled.
     #[cfg(target_arch = "wasm32")]
     CenterlineLinetypeFilePicked(Option<(String, String)>),
+    /// Web DATALINK: the picked .csv file's name and raw bytes — registered
+    /// in the picked-source registry, then fed to the same table-insert path
+    /// the native typed-path command uses. `None` = cancelled.
+    #[cfg(target_arch = "wasm32")]
+    DataLinkCsvPicked(Option<(String, Vec<u8>)>),
     /// Append one typed character to the command-line input from the
     /// global key-press subscription. Used when the text-input widget
     /// itself isn't focused (focus parked on viewport / button / etc.)
@@ -4403,6 +4408,16 @@ impl OpenCADStudio {
     fn boot_web() -> (Self, Task<Message>) {
         #[cfg_attr(target_arch = "wasm32", allow(unused_mut))]
         let mut s = Self::new();
+        // A web host that intends to automate can opt in before the first
+        // control request by setting `opencadstudio.automation` to "1" in
+        // localStorage (the same pre-load mechanism the settings use): the
+        // startup donation prompt then never queues (#1349).
+        if web_sys::window().and_then(|window| window.local_storage().ok().flatten()).and_then(
+            |storage| storage.get_item("opencadstudio.automation").ok().flatten(),
+        ) == Some("1".to_string())
+        {
+            s.control.automation_seen = true;
+        }
         s.queue_startup_prompts();
         let focus = s.focus_cmd_input();
         let primary_font =