bonsaiviewer: rework add-models false-origin guess + drop fly-mode input lag

Two independent threads that landed on this branch.

## 1. Federation false-origin guess: arm-on-add + frame-on-origin

The cc54237f5 fix moved the guess off the refresh() fan-in (terminating
the stack-overflow recursion on Holter Tower), but the gating was still
`modelIds().size() == 1` — broken for batch-add-into-empty-session
because the session registry is populated synchronously by all
addModel calls before any modelGeometryReady lands. Result: load 3
files at once → none of the per-model geometry-ready events ever
finds `size() == 1` → guess never fires → camera + federation origin
stay at surveyor coords.

Rework:

* **Arm/consume at the command boundary.** modules/models/Commands
  exposes `armFederatedFalseOriginGuess` / `consumeFederatedFalseOrigin
  Guess` (function pair — arming is a one-shot, raw-bool would let a
  peek-without-clear silently break the contract). `addModel` and the
  cloud-callback in `addModelFromCloud` arm if `modelIds().isEmpty()`
  at the moment they're about to register federation entries. The
  first geometry-ready then consumes the arm and runs the guess —
  batch add or single, works the same way.

* **Lazy first geometry point from mesh AABB centre.** Drop
  SceneLoader's `firstPlacement(mid)` / `first_placement` /
  `has_first_placement` and the two capture sites entirely. The
  viewport keeps CPU-side MeshInfo + InstanceCpu for picking /
  measurement; compute the anchor on demand via new const accessor
  `WgpuViewportWindow::firstGeometryPointWorldM(mid, out)` =
  instance0.placement × meshes[instance0.mesh_id].aabb_centre.
  This is more representative than the placement translation
  (placements often live far from the actual geometry due to long
  ObjectPlacement chains / intermediate local frames), and lighter
  storage-wise (lazy, vs. 128 B per model held just-in-case).

* **`guessFederatedFalseOrigin` math signature: Matrix4d → Vector3d.**
  The function only ever consumed `.block<3,1>(0,3)`; the Matrix4d
  API surface was a strictly-larger-than-necessary contract. Vector3d
  matches what the function actually needs.

* **`WgpuViewportWindow::frameOnFederatedOrigin(mid, max_distance_m)`**
  replaces the post-shift use of viewAll() that the ViewportView
  almost reached for. The federated false origin sits at (0,0,0) in
  post-shift space by construction, so the camera targets there
  directly; distance fits the model's post-shift AABB diagonal with
  viewAll's padding math, clamped to `max_distance_m` so a model
  with one crazy-coord outlier vertex can't pull the camera back so
  far the real geometry becomes a pixel. Called with 100 m cap from
  the guess. Unlike viewAll() this only iterates the one model the
  guess fired for — the "load 10 models, viewAll shows nothing"
  failure mode is structurally avoided.

* **ViewportView::tryGuessFirstModelFalseOrigin** renamed to
  `guessFederatedFalseOriginFromFirstModel` and the body restructured
  to consume the arm, look up the anchor via the viewport, mutate
  the federation origin (which propagates through SessionState's
  federatedFalseOriginChanged relay → refresh() → recompose all
  instance world AABBs), then `frameOnFederatedOrigin(mid, 100)`.

* **Internal guards preserved.** filePath skip (project files own
  the origin), current==defaults skip (don't clobber a user who
  set the origin manually then removed the model), placement /
  georef availability checks — defense-in-depth around the arm, not
  the primary gate. The arm-only flow means re-arming on add-into-
  empty-session is naturally re-firable: add → remove → add will
  retry if the previous guess returned defaults.

## 2. wgpu present-mode: prefer Immediate above FifoRelaxed

On Linux Vulkan stacks where the driver / compositor doesn't advertise
Mailbox (confirmed on the user's setup — capability log added in this
patch reports just `fifo, fifo_relaxed, immediate`), Fifo's 2–3 frame
queue doubles input-to-photon latency the moment WASD activates
(~16 ms render-body fully consumes the budget, so the queue is held
deep). On a 60 Hz display this reads as "less smooth than the 100 fps
HUD suggests" during fly-mode mouse-look-while-moving — confirmed by
WGPU_FLY_DEBUG dt traces (rock-solid 16-17 ms cadence, so it's not
frame pacing — it's latency).

Promote Immediate above FifoRelaxed in the preference order so that
when Mailbox is unavailable we pick the no-queue option (can tear
under fast motion, but tearing on architectural geometry is usually
invisible while the latency win is immediately felt). Also log the
full advertised capability list on first configure so future "why
isn't Mailbox available?" diagnostics don't need a code patch.

Mailbox remains first preference; Fifo remains the spec-guaranteed
final fallback.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/ifcviewer-wgpu/WgpuViewportWindow.h

@@ -390,6 +390,36 @@ public:
     };
     bool findInstance(uint32_t object_id, InstanceLookup& out) const;
 
+    // A point that actually lies on the model's first instance — the
+    // first instance's mesh AABB centre transformed by that instance's
+    // placement, in metres, pre-CoordinateOperation. Lookup only — the
+    // viewport already keeps the CPU-side MeshInfo + InstanceCpu around
+    // for picking / measurement; the federation false-origin guess
+    // (ViewportView::guessFederatedFalseOriginFromFirstModel) consumes
+    // this lazily on modelGeometryReady. Returns false when the model
+    // is unknown or has no instances.
+    bool firstGeometryPointWorldM(uint32_t model_id,
+                                  Eigen::Vector3d& out) const;
+
+    // Re-frame the camera onto the federated false origin in post-shift
+    // space. After ViewportView's first-model false-origin guess sets a
+    // federation origin and the resulting recomposeAndUploadModel runs,
+    // the federation false origin (in world coords) maps to (0,0,0) in
+    // render coords — so we target (0,0,0) and the first model's
+    // anchor point sits dead-centre.
+    //
+    // Distance comes from the model's post-shift AABB diagonal with the
+    // same padding math as viewAll(), but clamped to `max_distance_m`
+    // so a model with one crazy-coord outlier vertex (16 km AABB
+    // diagonal because of one bad triangle) can't pull the camera so
+    // far back that the bulk of the geometry becomes a single pixel.
+    // Yaw/pitch unchanged — preserves the user's current look direction.
+    //
+    // Unlike viewAll() this *never* iterates all loaded models — it
+    // frames around the specific model the guess fired for, ignoring
+    // models with bad coordinates elsewhere in the session.
+    void frameOnFederatedOrigin(uint32_t model_id, float max_distance_m);
+
     // Selection accessor. Exposed for callers (bonsai's volume readout)
     // that need to read selectionIds() / activeObjectId(). Mutation goes
     // through the existing setSelection / pick paths.