ifcviewer: budget the geometry cache and make required allocations fallible

Loading enough models drove the chunk pool to the driver's refusal point,
after which the first click aborted: the pick attachments are allocated
lazily, wgpu-native reported their OOM as a validation error nobody
observed, and the invalid views reached wgpuQueueSubmit, which panics
across the FFI boundary. Two policy defects compounding: the cache was
allowed to take the last byte, and nothing but the pool's own growth was
treated as fallible.

GPU memory is now two tiers. Required allocations (per-pixel attachments,
a model's metadata buffers, readback staging) are eager, deterministic
and fallible; the chunk pool is an elastic cache that grows only to a
budget and yields whenever a required allocation fails.

- GpuBudget (pure, unit-tested): desktop derives the budget from the
  driver's free-memory report minus a reserve for the attachments at 4K;
  web keeps the wasm-heap cap; either lowers it on pressure. The budget's
  source differs per platform, the mechanism does not.
- GpuAllocScope: the OOM/Validation error-scope dance in one place,
  synchronous on wgpu-native, provisional on Dawn-web. BufferPool's
  inline copy now uses it.
- BufferPool::shrinkToCapacity releases whole sub-buffers newest-first
  after the owner empties them; growth clamps to the budget instead of
  overshooting.
- ViewportCore::allocateRequired runs any required creation under a
  scope and, on failure, lowers the budget, evicts and releases cache
  sub-buffers, waits for the device to reclaim them, and retries until
  it fits or the cache is at its floor. Pick attachments are created with
  the other attachments in configureSurface; render() skips a frame
  rather than submit invalid views; a model whose buffers cannot fit is
  not loaded instead of aborting.

Verified on a 4 GB GeForce: the pool clamps itself at the derived budget
(256+256+67 MB for a 579 MB budget) and, in a standalone check against
the real device, a pool grown to the driver's refusal point observes a
failed required allocation, releases 320 MB and succeeds on retry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/ifcviewer/FrameStats.h

@@ -38,11 +38,12 @@ struct FrameStats {
     std::uint32_t unique_meshes;
     std::uint32_t gl_draw_calls;        // wgpu draw-call count; name kept for bonsai parity
     std::uint32_t indirect_sub_draws;   // sub-draws packed into the chunk-indirect lists
-    // Chunk geometry pool occupancy (see BufferPool). wgpu exposes no
-    // adapter-wide VRAM query, so this is the viewer's own allocation,
-    // not the device total.
+    // Chunk geometry pool occupancy (see BufferPool): bytes held by
+    // resident chunks, the pool's current capacity, and the budget the
+    // pool may grow to (GpuBudget; 0 when still unbounded).
     std::uint64_t vram_used_bytes;
     std::uint64_t vram_capacity_bytes;
+    std::uint64_t vram_budget_bytes;
     // Whole-device VRAM from the driver (NVML / sysfs, see GpuMemory.h).
     // Desktop only; zero on web or when no backend could answer, so
     // consumers must treat 0 as "unknown" rather than as empty.