ifcviewer-web: stream remote sidecars over HTTP Range (?model=URL)

Adds a network byte-source alongside the local Blob one. The async-chunk
infra is source-agnostic — only the two JS primitives knew it was a Blob —
so this generalises them and reuses everything else:

  - ifcvReadRangeInto: local → Blob.slice; remote → fetch() with a Range
    header (206). If a server ignores Range and returns 200, the requested
    window is sliced out so it still works (without the bandwidth saving).
  - ifcvFileSize: Blob size, or the URL's total length resolved up front.
  - ifcvBeginUrlSource: resolves total size (HEAD Content-Length, else a
    0-0 ranged GET's Content-Range) then fires _ifcv_source_ready.
  - The metadata bootstrap is extracted into a source-agnostic
    loadSidecarMetadataWeb(label); loadSidecarFromBlobWeb / FromUrlWeb are
    thin entries. streaming_from_blob → streaming_from_web (now covers both).

main_web exports load_sidecar_from_url_c(url); shell.html reads a
?model=URL query param and ccalls it once the app is live (same-origin
needs no CORS; cross-origin hosts must send CORS + Accept-Ranges).

Test: serve.mjs now answers HEAD + Range (206) and falls back to the
ifcviewer-web source dir for sample.ifcview (embedded in the wasm, not in
build-web). New smoke case loads ?model=/sample.ifcview and asserts it
renders via the Range path. 6/6 web smoke + 107/107 unit pass; desktop
unaffected (web-guarded; only the shared field rename touches it).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/ifcviewer-web/shell.html

@@ -71,11 +71,20 @@
       // chain — which is the configuration that stalls device-callback
       // delivery (verified during web bring-up).
       var collapsedOnce = false;
+      var urlLoadTried = false;
+      var modelUrl = new URLSearchParams(location.search).get('model');
       function shellTick() {
         if (Module._app_ptr && Module._raf_tick_c) {
           // First time the app goes live, collapse the log overlay so it
           // stops covering the viewport.
           if (!collapsedOnce) { statusEl.classList.add('ready'); collapsedOnce = true; }
+          // ?model=URL streams a remote sidecar via HTTP Range once the app
+          // is live (one-shot). Same-origin needs no CORS; cross-origin URLs
+          // require the host to send CORS + Accept-Ranges headers.
+          if (!urlLoadTried && modelUrl && Module.ccall) {
+            urlLoadTried = true;
+            Module.ccall('load_sidecar_from_url_c', null, ['string'], [modelUrl]);
+          }
           Module._raf_tick_c(Module._app_ptr);
         }
         requestAnimationFrame(shellTick);