ocs_doc_api: fix branch-review findings (tab auth, bulge center, budget, caps, dead code)

CRITICAL:
- execute_doc_api: reject tab_id != bound tab (confused deputy); test
  doc_api_tab_mismatch_is_rejected.
- bulge_arc_segment: fix negative/CW bulge center (apothem magnitude + sign picks
  side; was double-sign-mirrored); test CW-vs-CCW center offset.
- cold-tess budget: move mass_cache/cold_tess_used to per-tab Scene so the budget
  persists across DocApi dispatches (was reset per request); budget-exhausted ->
  approximate meshes.metrics fallback instead of error.

WARNING:
- Loft: add BULK_ITEM_CAP (was uncapped -> unbounded kernel call from one request).
- CreateMany: pre-validate EntitySpec::Curve (ellipse ratio) in prepare phase ->
  all-or-nothing restored; regression test.
- Partial Ellipse: offset start/end_parameter by rot_z on rotation; regression test.
- resolve_body: add with_body borrow accessor (host overrides to borrow cache in
  place, O(1)); bounds() uses it instead of deep-cloning the B-rep per query.
- add_raster_image: validate file path (non-empty, image extension, reject
  UNC/traversal); regression test.

SUGGESTION:
- deploy: bump API_VERSION 5 -> 6 so DocApi plugins are gated at handshake on old
  hosts (append-only wire + defaulted method keep old V2-V5 plugins loading).
- dead code: wire query_name into apply_queries error labels; host uses crate's
  ObjectId::from_handle/to_handle (drop local duplicates); delete is_null/backend_mut.
- mock drift: test mock now stores curve specs + computes curve bounds (aligns with
  example mock); Spline/Dimension bounds delegate to points_aabb.

623 host lib + 8 crate + 3 consistency + 34 plugin_api green.

src/app/plugin_host.rs

@@ -18,10 +18,6 @@ pub(crate) struct HostSession<'a> {
     doc_store: Option<DocumentSnapshotStore<DocumentViewData>>,
     /// In-flight DocApi v2 undo delta (between `push_undo` and `finalize_op`).
     doc_api_pending: Option<super::history::PendingDelta>,
-    /// Memoized volume/centroid per (handle, geometry_epoch) for DocApi mass queries.
-    pub(crate) mass_cache: std::collections::HashMap<Handle, (u64, f64, [f64; 3])>,
-    /// Per-session count of cold-cache mass tessellations (budget for query DoS).
-    pub(crate) cold_tess_used: usize,
 }
 
 impl<'a> HostSession<'a> {
@@ -31,8 +27,6 @@ impl<'a> HostSession<'a> {
             tab,
             doc_store: None,
             doc_api_pending: None,
-            mass_cache: std::collections::HashMap::new(),
-            cold_tess_used: 0,
         }
     }