fix: final pre-PR review sweep

The final holistic + quality audit (three reviewers) returned GO with
four majors; all fixed.

- Start-page recents were the last unguarded writer of the open slot
  on web: clicking one under the open overlay clobbered the in-flight
  open and silently lost its bytes. Refused with the same in-progress
  notice the picker uses.
- The web quit-after-save continuation stalled: a Quit pending now
  survives the tab-save AND continues — offering to save the next
  dirty tab or finishing the quit, mirroring native.
- Data-extraction's multi-file pick is capped (16): every picked file
  becomes a full parsed document held for the session, and one giant
  pick could exhaust the wasm heap.
- The xref registry tests raced each other on the process-global
  registry (reproduced 3/10 at high thread counts — CI roulette); they
  now hold a module-level guard.

Minors: the collision warning is cataloged in all 21 locales; the
docs' parallelism detail header no longer contradicts its own table;
the drop-filter and name-hash helpers gained inline tests (their only
prior coverage was a verbatim copy in the red-team suites).

src/app/annotation_data.rs

@@ -1589,6 +1589,16 @@ impl OpenCADStudio {
                     .pick_files()
                     .await
                     .unwrap_or_default();
+                // Each picked file becomes a full parsed document held in
+                // the registry for the session; a bound keeps a giant
+                // multi-pick from exhausting the wasm heap (tab death).
+                const MAX_EXTRACTION_SOURCES: usize = 16;
+                if handles.len() > MAX_EXTRACTION_SOURCES {
+                    return Err(crate::tf!(
+                        "At most {MAX_EXTRACTION_SOURCES} drawings can be added in the browser."
+                    )
+                    .into_owned());
+                }
                 let mut paths = Vec::new();
                 for handle in handles {
                     let name = handle.file_name();