perf(app): deduplicate and budget browser bundles

[melonamin]

Summary

• make packages/core/wasm the canonical browser WASM source and remove the legacy app/public/wasm mirror
• lazy-load optional views, ELK layout, Librarian, sharing, image export, PDF parsing, and embeddings
• add manifest-based startup, async chunk, WASM, total JavaScript, and distribution budgets with focused tests
• enforce the budgets from the existing demo app build CI step and document every supported loading path

Why

Vite already emitted the package-owned WASM imported through @pondpilot/flowscope-core, while the Rust build also copied the same binary into app/public. Production and embedded CLI builds therefore shipped two roughly 8.9 MB WASM files. Optional heavyweight browser features were also reachable from the startup graph, producing a roughly 6.7 MB entry chunk, and the build only warned instead of enforcing a regression limit.

Impact

• WASM delivery: 17,816,184 B across two files → 8,908,092 B in one file (-50.0%)
• entry JavaScript: 6,697,818 B → 2,643,009 B (-60.5%)
• total JavaScript: 10,441,936 B → 8,001,861 B (-23.4%)
• total app distribution: 28,390,923 B → 17,039,481 B (-40.0%)

Direct dev/build commands clean stale legacy mirrors before Vite starts. CLI serve embeds the same budget-checked app output, npm/browser package loading still resolves the package-owned module, and the VS Code extension keeps its separate Node-target WASM path.

Validation

• just build-wasm
• yarn workspace @pondpilot/flowscope-app test (349 tests)
• yarn workspace @pondpilot/flowscope-app build
• yarn workspace @pondpilot/flowscope-app check:bundle
• just build-cli-serve
• yarn workspaces run typecheck
• yarn workspaces run lint
• VS Code webview production build
• git diff --check
• iterative codex review --uncommitted; fixed all valid findings, final pass found no actionable defects