feat(open): open drawings in the running editor

Double-clicking a drawing started a whole second copy of the app. Now it
lands as a tab in the editor already open, and that window comes forward.

The election is the bind itself: every GUI launch tries a deterministic
per-user loopback port, and the OS grants it to exactly one process and
releases it on any death, SIGKILL included. Nothing to reap, no PID to
probe, no stale lock after a crash. The winner serves the port from an
iced subscription; the loser checks it is talking to a matching editor,
hands the paths over and exits. Every surprise — no answer, a stranger on
the port, a timeout — boots a normal window, i.e. the old behaviour: the
feature can degrade, but it cannot lose the file.

The gate in main is positional, after every headless mode has returned.
The plugin runner is this same binary re-spawning itself, so a flag list
would rot the first time a mode is added; a position cannot.

Handing a drawing over that is already open switches to its tab instead
of loading a second copy, comparing resolved paths so a symlink or a
`..` hop is still recognised as the same file.

`opening` is a single slot that a second open would overwrite, and
on_file_opened drops any result arriving once it is clear — so drawings
handed over at once would silently vanish. They queue in pending_opens,
drained from every path that clears the slot, error and cancel included.

Exec becomes %F so one launch takes the whole selection; the CLI takes a
list and boot fans it out through the same door. --new-instance forces a
separate process; --read-only / --script / --new always get their own.

Not reused: the automation server. It dispatches arbitrary commands and
writes arbitrary paths, and its open replaces the active tab's document
in place — publishing that on a port every local process can reach would
be unforced privilege escalation. Only its JSON-lines framing is shared.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/mod.rs

@@ -685,6 +685,13 @@ pub(super) struct OpenCADStudio {
     /// `Some` while a CAD file is loading — drives the modal overlay.
     /// Cleared when the load finishes, errors, or the user cancels.
     pub(super) opening: Option<OpenProgress>,
+    /// Drawings handed to us by other launches while `opening` was busy.
+    /// `opening` is a single slot that a second `OpenPathPicked` would
+    /// overwrite, and `on_file_opened` drops any result arriving once it is
+    /// clear — so overlapping opens silently lose documents. Selecting several
+    /// drawings in a file manager produces exactly that (one process per file,
+    /// all arriving at once), which makes this queue load-bearing, not polish.
+    pub(super) pending_opens: std::collections::VecDeque<PathBuf>,
 
     // ── Unsaved-changes dialog ────────────────────────────────────────────
     /// Set when the user tries to close a tab or quit while there are unsaved changes.
@@ -1230,6 +1237,9 @@ pub enum Message {
     /// Open a path from the Start tab's recent-documents list (skips the
     /// file picker; the path is already known).
     OpenRecent(PathBuf),
+    /// A second launch handed us a drawing to open (single instance). Queued
+    /// behind any open already in flight — see `pending_opens`.
+    OpenExternal(PathBuf),
     /// Open a URL in the system browser (start-page intro video, links).
     OpenUrl(String),
     /// Select which section a narrow (tabbed) Start page shows.
@@ -2260,6 +2270,7 @@ impl OpenCADStudio {
             plot_dialog: crate::ui::window::plot::PlotDialogState::default(),
             plot_prev: None,
             opening: None,
+            pending_opens: std::collections::VecDeque::new(),
             pending_close: None,
             save_dialog_format: "DWG 2018".to_string(),
             save_dialog_filename: "drawing.dwg".to_string(),
@@ -2500,16 +2511,23 @@ impl OpenCADStudio {
             Message::UpdateCheckResult,
         );
         let focus_cmd = s.focus_cmd_input();
-        // Startup configuration from the command line (see `cli`). A file
-        // argument — also how the OS file association launches us when a .dwg
-        // is double-clicked — opens via `OpenRecent`, which existence-checks
-        // the path and reports a clean error if it is bogus. `--new` opens a
-        // fresh drawing tab instead of the welcome screen. `--read-only`
-        // disables saving. `--script` queues command lines to run once up.
+        // Startup configuration from the command line (see `cli`). File
+        // arguments — also how the OS file association launches us when
+        // drawings are double-clicked — go through `OpenExternal`, the same
+        // door a second launch hands files to: it existence-checks each path,
+        // skips one already open, and queues the rest behind the load in
+        // flight. Handing them straight to `OpenRecent` would let each
+        // overwrite the single `opening` slot and silently drop all but one.
+        // `--new` opens a fresh drawing tab instead of the welcome screen.
+        // `--read-only` disables saving. `--script` queues command lines.
         let cfg = crate::cli::gui_config();
         s.read_only = cfg.read_only;
-        let cli_open: Task<Message> = if let Some(p) = cfg.file {
-            Task::done(Message::OpenRecent(p))
+        let cli_open: Task<Message> = if !cfg.files.is_empty() {
+            Task::batch(
+                cfg.files
+                    .into_iter()
+                    .map(|p| Task::done(Message::OpenExternal(p))),
+            )
         } else if cfg.new {
             Task::done(Message::TabNew)
         } else {