moly: Add player data import and improve runtime reliability

[nichinichisou0609]

Add player layout import to Settings, set the application version to 0.0.1, and handle runtime, persistence, and asset-loading failure paths.

Changes

• Add CN/JP UID fetching and JSON selection, preview, import, and backup restoration. Preserve instance IDs, wall placement, palettes, and rank-based site selection; reject stale previews and unsaved editor conflicts.
• Keep editing footprints fallible until placement validation succeeds. Invalid moves and rotations produce placement errors while the draft can still be corrected or cancelled.
• Use haruki-api.menardi.top by default, with a same-origin browser relay and optional Worker entry point. Stream native and browser import reads, check file sizes before opening streams, serialize transfers, cancel active reads, and discard stale completions.
• Queue temporary pack byte-budget pressure fairly, reserve identity payloads without a decompression buffer, and release reader budgets when content is consumed or dropped. Retain hard transfer, decoded-size, expansion, and concurrency limits.
• Share application plugin assembly and make simulation scheduling dependencies explicit. Preflight browser graphics support, select separate WebGPU/WebGL2 modules, and show a reload/retry page on failure.
• Lock native settings transactions, use unique atomic temporary files, and grant browser write access to one tab through Web Locks.
• Isolate development-server request failures, enforce canonical asset paths, key shared reads by their complete representation, and validate checker exit status and run identity.
• Add workspace version reporting and static CI for version metadata, JavaScript syntax, source boundaries, and commit whitespace. CI does not build or package the application.

Validation

• cargo test --release --workspace --lib -- --test-threads=1: 528 passed, 6 existing tests ignored. Synthetic tests cover candidate overflow, command handling, unchanged storage, delayed concurrent readers, fair admission, cancellation, HTTP limits, and stale completions.
• Native release build and version output; separate WebGPU and WebGL2 WASM release builds and actual browser startup/settings checks.
• Browser checks against the production Rust IO module: 11 passed, including exact 32 MiB, unterminated oversized streams, file-size rejection before stream creation, and cancellation. Real browser file selection accepted a small file and rejected a 32 MiB + 1 byte file.
• The full WebGPU app completed JSON selection, preview, import of 850 furniture instances, oversized-file rejection with the imported scene retained, and backup restoration without browser runtime errors.
• Local captured-data import, restart, and restore: 850 live furniture instances and 144 alternate-color bindings; rank-selected levels, 12 wall placements, 64-bit IDs, stale-preview rejection, and exact backup restoration.
• Native process contention and storage receipts; shared pack identity and read limits; malformed HTTP requests and linked paths; scheduling dependencies; actual checker success/failure arms.
• Workspace version, JavaScript/server checks, public source boundary, and whitespace checks.

The pack byte quota covers buffers held by readers; data already handed to loaders and GPU resources are outside it. Seeking loaders can use Bevy's VecReader fallback. Custom images, ornaments, wallpaper, and floor appearances are retained as records but are not rendered. Successful UID fetches used captured-response replay; a valid live player UID was not available. Game assets and player data are not included.

The corresponding import-resource exporter is included in empty-sekai/moly-root#1.