fix: one VRAM-aware buffer budget for every GPU upload path

max_buffer_size is an API validation limit, not physical VRAM. NVIDIA
reports several GB of it on a 2 GB card, so sizing a chunk from it
produces buffers larger than the whole device. That is the same bug as
#203 (mesh_gpu), #358 (face3d_gpu) and the block-wire vertex buffer:
rediscovered three times because each upload path spelled the budget out
for itself.

mesh_gpu.rs was the only site that clamped the result. Move that clamp
into src/scene/pipeline/gpu_budget.rs and route every allocating path
through it, so a new upload path cannot reintroduce the mistake by
copying one of the unclamped expressions.

Five sites had no clamp at all: text_gpu (block-text instances),
wire_gpu (block-wire instances), and face3d_gpu (vertices, instances,
and upload_chunks).

Three behaviour changes worth noting:

  * Silhouette chunks were capped at a private 64 MiB constant and now
    use the shared 32 MiB budget.
  * The storage-hatch chunk limit was the minimum of two device limits,
    both of them validation figures; it is now also capped by the
    budget. The `*_fits` predicates next to it are genuine "would wgpu
    reject this" checks and are left alone.
  * mesh_gpu's instanced path used the unclamped ceiling to decide
    whether a mesh fits in a single buffer, which would still admit a
    multi-GB allocation. It now uses the clamped budget, so a few more
    meshes take the chunked path.

OCS_GPU_CHUNK_MIB overrides the cap. Raising it above the real VRAM is
the cheapest way to force an allocation failure and check that the
renderer degrades instead of aborting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/scene/pipeline/mod.rs

@@ -1,5 +1,6 @@
 mod device_capabilities;
 pub mod face3d_gpu;
+pub mod gpu_budget;
 pub mod hatch_gpu;
 pub mod wipeout_gpu;
 pub mod image_gpu;
@@ -2728,11 +2729,7 @@ impl Pipeline {
             .normalize_or(glam::DVec3::NEG_Z);
         use crate::scene::pipeline::mesh_gpu::{SilhouetteInstance, SilhouetteVertex};
         use wgpu::util::DeviceExt;
-        const SILHOUETTE_CHUNK_BYTES: u64 = 64 * 1024 * 1024;
-        let chunk_bytes = device
-            .limits()
-            .max_buffer_size
-            .min(SILHOUETTE_CHUNK_BYTES) as usize;
+        let chunk_bytes = gpu_budget::buffer_budget(device);
         let max_vertices = chunk_bytes / std::mem::size_of::<SilhouetteVertex>() / 2 * 2;
         if max_vertices < 2 {
             self.silhouette_chunks.clear();