feat: web automation wrapper (#1349), DATALINK table on web, System theme; honest decode accounting

Ported from 2c38de53 (#1717). Main already carries the hatch PDF draw
order fix (#1345), the numeric set_properties compare (#1348) and the
web open from bytes, so those parts stay out; what remains:

#1349 — window.ocsControl.ready/request promise wrapper with an
ocs-ready event (web/ocs-control.js, loaded by the web page), and the
startup donation prompt is suppressed once a control request is seen
(opt-in pre-boot via localStorage["opencadstudio.automation"] = "1").
docs/automation/web.md documents both. The control protocol stays at 1.

DATALINK CSV-to-table works on web (picker + bytes through the session
registry — was std::fs, silently dead); COLORSCHEME accepts System
(prefers-color-scheme on web, AppsUseLightTheme on Windows).

Decode accounting, made honest per the fix-of-fix review: into_rgba8
allocates the RGBA destination while the native buffer is alive for
every non-Rgba8 layout (L8 5, La8 6, Rgb8 7, L16 6, La16 8 B/px
peaks — the formula now says so), GIF bills the screen+frame
coexistence at 8 B/px, and TIFF drops the 3x multipliers both ways —
tiff 0.11 splits the given budget between frame and scratch (a total
ceiling), so the old double-billing refused honest 16-bit GeoTIFFs
~2.25x early while admitting hostile chunk transients at 3x.

(cherry picked from commit 2c38de53)

docs/automation/web.md

@@ -16,7 +16,14 @@ control channel is ready once `window.wasmBindings?.ocs_control_submit` is defin
 | `ocs_control_submit(request: string) → string` | Queues one request (a JSON string) and returns a ticket immediately. |
 | `ocs_control_take(ticket: string) → string \| undefined` | Returns the reply (a JSON string) once it is ready, `undefined` before that. A reply is removed when taken. |
 
-Poll `ocs_control_take` until it returns a reply, as the smoke test does:
+The page also loads `ocs-control.js`, which wraps the two functions in promises:
+
+| API | Behaviour |
+|---|---|
+| `await window.ocsControl.ready` | Resolves once the control channel exists; the `ocs-ready` window event fires at the same moment. |
+| `await window.ocsControl.request(request, {timeoutMs, pollMs})` | Submits one request and resolves with the final reply, following `accepted`/`running` replies through `op: "operation"`. Rejects only on timeout or a missing channel. |
+
+Without the wrapper, poll `ocs_control_take` until it returns a reply, as the smoke test does:
 
 ```js
 async function control(request) {
@@ -55,7 +62,9 @@ rather than a disk, so use `data_base64` for a file the page has not seen.
 
 A dialog can be open when the page is ready. The donation prompt appears once per
 application version in each browser profile, so a fresh or disposable profile always
-sees it. While a modal is open `state.modal` is set, and `{"op":"new"}` returns `ok`
+sees it — unless the session is automated: the first control request drops a prompt
+that is still queued, and a host that sets `localStorage["opencadstudio.automation"]`
+to `"1"` before the page loads never gets one. A prompt already on screen stays. While a modal is open `state.modal` is set, and `{"op":"new"}` returns `ok`
 without creating a tab until the modal is closed. Close it first:
 
 ```js