ocs_doc_api: fix branch-review findings (tab auth, bulge center, budget, caps, dead code)

CRITICAL:
- execute_doc_api: reject tab_id != bound tab (confused deputy); test
  doc_api_tab_mismatch_is_rejected.
- bulge_arc_segment: fix negative/CW bulge center (apothem magnitude + sign picks
  side; was double-sign-mirrored); test CW-vs-CCW center offset.
- cold-tess budget: move mass_cache/cold_tess_used to per-tab Scene so the budget
  persists across DocApi dispatches (was reset per request); budget-exhausted ->
  approximate meshes.metrics fallback instead of error.

WARNING:
- Loft: add BULK_ITEM_CAP (was uncapped -> unbounded kernel call from one request).
- CreateMany: pre-validate EntitySpec::Curve (ellipse ratio) in prepare phase ->
  all-or-nothing restored; regression test.
- Partial Ellipse: offset start/end_parameter by rot_z on rotation; regression test.
- resolve_body: add with_body borrow accessor (host overrides to borrow cache in
  place, O(1)); bounds() uses it instead of deep-cloning the B-rep per query.
- add_raster_image: validate file path (non-empty, image extension, reject
  UNC/traversal); regression test.

SUGGESTION:
- deploy: bump API_VERSION 5 -> 6 so DocApi plugins are gated at handshake on old
  hosts (append-only wire + defaulted method keep old V2-V5 plugins loading).
- dead code: wire query_name into apply_queries error labels; host uses crate's
  ObjectId::from_handle/to_handle (drop local duplicates); delete is_null/backend_mut.
- mock drift: test mock now stores curve specs + computes curve bounds (aligns with
  example mock); Spline/Dimension bounds delegate to points_aabb.

623 host lib + 8 crate + 3 consistency + 34 plugin_api green.

crates/ocs_doc_api/src/backend.rs

@@ -19,9 +19,22 @@ pub type KernelBody = cadkernel::brep::Body;
 pub trait DocApiBackend {
     // ── identity / solid lookup ────────────────────────────────────────────
     /// Resolve a live B-rep body for `id` (solid cache; re-lift from AcisData on
-    /// miss). `UnknownId` if `id` is not a live solid.
+    /// miss). `UnknownId` if `id` is not a live solid. NOTE: returns an OWNED body
+    /// (a clone of the cache entry); use `with_body` for read-only queries.
     fn resolve_body(&mut self, id: ObjectId) -> ApiResult<KernelBody>;
 
+    /// Borrow the cached body read-only for a query, avoiding the `resolve_body`
+    /// deep clone. Default: falls back to `resolve_body` (clone). The host overrides
+    /// this to borrow the `solid_models` cache in place (O(1), no copy).
+    fn with_body<R>(
+        &mut self,
+        id: ObjectId,
+        f: &mut dyn FnMut(&KernelBody) -> ApiResult<R>,
+    ) -> ApiResult<R> {
+        let body = self.resolve_body(id)?;
+        f(&body)
+    }
+
     /// Store a new solid body as a `Solid3D` entity; returns the fresh `ObjectId`.
     /// Mirrors host `add_solid_model` (edge wires + `solid_to_sat` +
     /// `set_sat_document` + `register_solid_model`).