feat: restore-all session recovery, ?file= deep links, offline PWA

Session recovery: more than one pending snapshot adds a 'Restore all'
button to the Recover Drawing modal — every snapshot goes through the
exact same guarded path as a single restore (deleted only after its
own open succeeds). The open-tab list and active tab persist to
localStorage on web (open/save/close) and the remembered tab is
re-selected once a restore batch settles; the modal notes how many
drawings the session had. Nothing is auto-opened.

Deep links: ?file=<url|name> opens a drawing at boot. http(s) URLs
must end in .dwg/.dxf and are fetched with the same streaming,
64 MB-capped, 8 s-deadline reader the remote images use, then go
through the guarded open queue; cross-origin opens announce the
origin first. Bare names resolve from the browser's recent storage,
with a hint when absent. Everything else (file:, javascript:, drive
letters, non-drawing tails) is refused with a console note.

Offline PWA: the app was installable (manifest) but downloaded its
55 MB bundle on every visit. A cache-first service worker now serves
the whole bundle from Cache Storage after one online visit —
navigations network-first so updates land, hashed assets
stale-while-revalidate, non-GET/cross-origin passthrough, old caches
cleaned on activate, and the waiting-worker update flow documented.
The Pages workflow stamps the cache version from the bundle hash and
fails if sw.js is missing or unstamped.

(cherry picked from commit 5f9b345e)

Ported onto main (#1717 review): the cache-version stamp moved from the
skipped build-web.sh wrapper into the Pages workflow; the tab-close hook
lands in main's on_tab_close, which also cancels pinned control requests.

src/scene/model/image_model.rs

@@ -1278,7 +1278,9 @@ mod web_fetch {
     /// The actual request. `GET url` with an abort signal armed at
     /// [`TIMEOUT_MS`]; the body is refused past [`MAX_BYTES`] using the
     /// declared `Content-Length` first and the received length second.
-    async fn fetch_once(url: &str) -> Result<Vec<u8>, RemoteFetchError> {
+    /// `pub(crate)` so the `?file=` deep link can fetch its drawing through
+    /// this exact reader (see `io::web_link`).
+    pub(crate) async fn fetch_once(url: &str) -> Result<Vec<u8>, RemoteFetchError> {
         use wasm_bindgen::JsCast;
         use wasm_bindgen_futures::JsFuture;
 
@@ -1369,6 +1371,10 @@ pub use web_fetch::{
     take_outcome as take_remote_fetch_outcome, take_overflowed,
     RemoteFetchError, RemoteFetchOutcome,
 };
+// The capped streaming reader itself, shared with the `?file=` deep-link
+// fetch (`io::web_link`) so both doors enforce the same 64 MB / 8 s bounds.
+#[cfg(target_arch = "wasm32")]
+pub(crate) use web_fetch::fetch_once as fetch_url_bytes;
 
 #[cfg(all(test, not(target_arch = "wasm32")))]
 mod tests {