docs: README and third-party notices for the React app

- README: setup with the HMDesign submodule/workspace, scripts,
  source layout (engine copied as is vs. new React components).
- THIRD-PARTY-NOTICES (root + served /licenses copy): acadrust MPL-2.0
  section unchanged; intro points at this app's dist/ and the in-app
  entry points; adds the UI runtime that @hm-design/ui brings in
  (React, Radix UI, lucide-react, class-variance-authority, shadcn CSS,
  Noto Sans KR) and HMDesign itself (#1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,78 @@
+# Third-party notices
+
+This viewer (dwg-dxf-viewer-hm — the React/HMDesign rebuild of
+dwg-dxf-viewer-sample) bundles third-party code. The notices below apply to the
+source tree **and** to the built site (`dist/`), because the build embeds the
+components listed here. In the app they are reachable from the GNB info button
+and the status-bar link "오픈소스 고지".
+
+Served copies of the license texts live under
+[`public/licenses/`](./public/licenses/) → `/licenses/…` on the deployed site.
+
+---
+
+## acadrust 0.4.1 — Mozilla Public License 2.0 — **MODIFIED**
+
+| | |
+|---|---|
+| Component | `acadrust` (DWG/DXF parser, Rust) |
+| Version | 0.4.1 |
+| License | MPL-2.0 — full text: [`public/licenses/acadrust-MPL-2.0.txt`](./public/licenses/acadrust-MPL-2.0.txt) (`/licenses/acadrust-MPL-2.0.txt`) |
+| Upstream | https://github.com/hakanaktt/acadrust · https://crates.io/crates/acadrust/0.4.1 |
+| Upstream commit | `f249c2f816acf36ee51cd5533716bdd443c2517e` (from the crate's `.cargo_vcs_info.json`) |
+| Author | Hakan AK |
+| Shipped as | compiled into `assets/acadrust_dwg_bg-*.wasm` (Executable Form) |
+
+**This copy is modified.** One file differs from the published crate:
+
+```
+src/io/dwg/dwg_stream_readers/object_reader/entities.rs   (read_mesh array-count bounds)
+```
+
+The modification bounds `read_mesh`'s array counts by the bits remaining in the
+object stream instead of the blanket 100 000-item guard, which truncated and
+thereby corrupted large SubD meshes.
+
+### How to obtain the Source Code Form (MPL-2.0 §3.2)
+
+1. Get the unmodified crate source — `cargo vendor`, or
+   `https://crates.io/api/v1/crates/acadrust/0.4.1/download`, or the upstream
+   commit above.
+2. Apply [`public/licenses/acadrust-0.4.1-read_mesh.patch`](./public/licenses/acadrust-0.4.1-read_mesh.patch)
+   (`/licenses/acadrust-0.4.1-read_mesh.patch` on the deployed site):
+
+   ```bash
+   tar xf acadrust-0.4.1.crate && cd acadrust-0.4.1
+   patch -p1 < acadrust-0.4.1-read_mesh.patch
+   ```
+
+The result is the exact Source Code Form of the acadrust code compiled into the
+shipped `.wasm`. Both the original and the modified file remain under MPL-2.0.
+
+---
+
+## dwg-wasm — MIT
+
+The wasm-bindgen wrapper that turns acadrust output into this viewer's
+`parseResult` (`hmwebviewer/rust/dwg-wasm/`). Our own code, MIT. MPL-2.0 §3.3
+permits distributing this Larger Work under different terms as long as the
+MPL-covered files above keep their license — which they do.
+
+---
+
+## Other components
+
+| Component | License |
+|---|---|
+| three.js | MIT |
+| dxf-parser | MIT |
+| opentype.js | MIT |
+| NanumGothic (`public/fonts/`) | SIL Open Font License 1.1 |
+| Viewer2D / sample glue / React app code | MIT |
+| React, React DOM, scheduler | MIT |
+| Radix UI (`radix-ui`), sonner, cmdk, vaul, embla-carousel, react-day-picker, react-resizable-panels, @tanstack/react-table, cn, tw-animate-css (via `@hm-design/ui`) | MIT |
+| lucide-react | ISC |
+| class-variance-authority | Apache-2.0 |
+| shadcn/ui CSS vendored by `@hm-design/ui` (`dist/vendor/shadcn-tailwind.css`) | MIT |
+| Noto Sans KR (HMDesign theme font, `dist/fonts/`) | SIL Open Font License 1.1 |
+| HMDesign (`@hm-design/ui`, git submodule `vendor/HMDesign`) | Internal design system; its package declares no license (see the submodule) |