feat: React19+HMDesign shell with ported DWG/DXF viewer engine

Scaffolds the new app (Vite+React19+Tailwind v4) on HMDesign via git
submodule + npm workspace, ports src/viewer2d/* and optionsStore.ts
unchanged, and rebuilds the vanilla UI (toolbar/layers/properties/
options panels, coord readout, license dialog, load progress) as HM
Design System components. Panel drag/collapse ported from
panelUtils.ts as a React hook; Measure UI intentionally left
unwired per original app parity.

Typecheck and dev-server module serving verified; in-browser
rendering not yet verified in this session (no browser tool
available) — needs manual check.

Refs #1

public/licenses/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,70 @@
+# Third-party notices
+
+This viewer bundles third-party code. The notices below apply to the source
+tree **and** to the built site (`dist2/`, deployed at
+`https://dwg-dxf-viewer-sample.pages.dev/`), because the build embeds the
+components listed here.
+
+Served copies of the license texts live under
+[`public/licenses/`](./public/licenses/) → `/licenses/…` on the deployed site.
+
+---
+
+## acadrust 0.4.1 — Mozilla Public License 2.0 — **MODIFIED**
+
+| | |
+|---|---|
+| Component | `acadrust` (DWG/DXF parser, Rust) |
+| Version | 0.4.1 |
+| License | MPL-2.0 — full text: [`public/licenses/acadrust-MPL-2.0.txt`](./public/licenses/acadrust-MPL-2.0.txt) (`/licenses/acadrust-MPL-2.0.txt`) |
+| Upstream | https://github.com/hakanaktt/acadrust · https://crates.io/crates/acadrust/0.4.1 |
+| Upstream commit | `f249c2f816acf36ee51cd5533716bdd443c2517e` (from the crate's `.cargo_vcs_info.json`) |
+| Author | Hakan AK |
+| Shipped as | compiled into `assets/acadrust_dwg_bg-*.wasm` (Executable Form) |
+
+**This copy is modified.** One file differs from the published crate:
+
+```
+src/io/dwg/dwg_stream_readers/object_reader/entities.rs   (read_mesh array-count bounds)
+```
+
+The modification bounds `read_mesh`'s array counts by the bits remaining in the
+object stream instead of the blanket 100 000-item guard, which truncated and
+thereby corrupted large SubD meshes.
+
+### How to obtain the Source Code Form (MPL-2.0 §3.2)
+
+1. Get the unmodified crate source — `cargo vendor`, or
+   `https://crates.io/api/v1/crates/acadrust/0.4.1/download`, or the upstream
+   commit above.
+2. Apply [`public/licenses/acadrust-0.4.1-read_mesh.patch`](./public/licenses/acadrust-0.4.1-read_mesh.patch)
+   (`/licenses/acadrust-0.4.1-read_mesh.patch` on the deployed site):
+
+   ```bash
+   tar xf acadrust-0.4.1.crate && cd acadrust-0.4.1
+   patch -p1 < acadrust-0.4.1-read_mesh.patch
+   ```
+
+The result is the exact Source Code Form of the acadrust code compiled into the
+shipped `.wasm`. Both the original and the modified file remain under MPL-2.0.
+
+---
+
+## dwg-wasm — MIT
+
+The wasm-bindgen wrapper that turns acadrust output into this viewer's
+`parseResult` (`hmwebviewer/rust/dwg-wasm/`). Our own code, MIT. MPL-2.0 §3.3
+permits distributing this Larger Work under different terms as long as the
+MPL-covered files above keep their license — which they do.
+
+---
+
+## Other components
+
+| Component | License |
+|---|---|
+| three.js | MIT |
+| dxf-parser | MIT |
+| opentype.js | MIT |
+| NanumGothic (`public/fonts/`) | SIL Open Font License 1.1 |
+| Viewer2D / sample glue | MIT |