holder + scad: SCAD source editor on /holder + new /scad universal renderer

Phase 2 — SCAD editor on /holder
================================
Some adjustments need more control than the parameter form gives
(e.g. tweaking the .scad logic itself). A collapsible CodeMirror-based
editor now slides up from the bottom of the viewport when you click
the "</> Source" button at the bottom-right.

- holder.html / holder.css: editor panel, toggle button, Reset and
  Close buttons. CodeMirror 5 loaded from cdnjs (single CSS + JS
  pair, clike mode for syntax highlighting since OpenSCAD is C-like).
- holder-app.js: lazy-initialises the editor on first show, fetches
  bundled source from /api/holder/source, tracks whether the editor
  content has been modified ("modified" tag in the panel title).
  When the editor is visible AND content differs from bundled,
  _doRender() switches from /api/holder/render -> /api/scad/render
  with {source, params}. Cell-count cap doesn't apply in that mode
  (the source may not even use the holder schema).

Phase 3 — Universal OpenSCAD playground at /scad
================================================
A standalone page for rendering arbitrary OpenSCAD. Paste code, click
Render (or Ctrl+Enter), see STL in the same Three.js viewer the
holder uses. Useful for prototyping new generators before wiring
them into a parameter form.

- New page: static/scad.html + scad.css + js/scad-app.js. Reuses
  holder-viewer.js (the Three.js scene module is generic enough).
- "Load example" populates a 6-hole rounded bracket so new users
  can verify the renderer works in two clicks.
- Same progress UI (elapsed timer + indeterminate bar + Cancel
  via AbortController) as /holder.
- Top nav now has Holder / Busbars / SCAD on every page.

Backend (shared by phase 2 & 3)
================================
- holder.py: split _run_openscad() out of render_stl(). New
  render_source(source, params=None) writes the source to a temp
  file and renders it; enforces MAX_SOURCE_BYTES (default 512 KB)
  and RENDER_TIMEOUT but skips the cell-count cap. New bundled_source()
  returns the hex_cell.scad text for editor pre-population.
- app.py: GET /api/holder/source returns the bundled .scad text.
  POST /api/scad/render takes {source, params?} and returns STL +
  X-Holder-Dimensions header. ValueError -> 400, RuntimeError -> 500.
  _stl_response() factored out so both render endpoints emit the same
  headers consistently.

app.py

@@ -44,6 +44,12 @@ def holder_page():
     return send_from_directory(STATIC_DIR, "holder.html")
 
 
+@app.get("/scad")
+def scad_page():
+    """Universal OpenSCAD renderer (paste any source, get STL)."""
+    return send_from_directory(STATIC_DIR, "scad.html")
+
+
 @app.get("/api/health")
 def health():
     return jsonify({"status": "ok", "openscad": holder.openscad_available()})
@@ -64,9 +70,21 @@ def holder_params():
     })
 
 
+def _stl_response(data: bytes, dims: dict, filename: str) -> Response:
+    return Response(
+        data,
+        mimetype="model/stl",
+        headers={
+            "Content-Disposition": f'attachment; filename="{filename}"',
+            "X-Holder-Dimensions": json.dumps(dims),
+            "Access-Control-Expose-Headers": "X-Holder-Dimensions",
+        },
+    )
+
+
 @app.post("/api/holder/render")
 def holder_render():
-    """Render STL for the supplied parameter overrides."""
+    """Render STL for the bundled hex holder with parameter overrides."""
     body = request.get_json(silent=True) or {}
     try:
         data, dims = holder.render_stl(body.get("params", {}))
@@ -74,19 +92,34 @@ def holder_render():
         return jsonify({"error": str(e)}), 400
     except (FileNotFoundError, RuntimeError) as e:
         return jsonify({"error": str(e)}), 500
-    return Response(
-        data,
-        mimetype="model/stl",
-        headers={
-            "Content-Disposition": 'attachment; filename="hex_holder.stl"',
-            # ECHO values from hex_cell.scad (pack/box dimensions). Used by
-            # the viewer to draw a max-bounding-box ghost for fit-check.
-            "X-Holder-Dimensions": json.dumps(dims),
-            # Make the custom header visible to fetch() in any CORS/proxy
-            # setup (Access-Control-Expose-Headers; harmless on same-origin).
-            "Access-Control-Expose-Headers": "X-Holder-Dimensions",
-        },
-    )
+    return _stl_response(data, dims, "hex_holder.stl")
+
+
+@app.get("/api/holder/source")
+def holder_source():
+    """Return the bundled hex_cell.scad text (for editor pre-population)."""
+    try:
+        return Response(holder.bundled_source(), mimetype="text/plain; charset=utf-8")
+    except FileNotFoundError as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.post("/api/scad/render")
+def scad_render():
+    """Render arbitrary user-supplied OpenSCAD source (no holder schema).
+
+    Body: {"source": "...", "params": {optional -D overrides}}
+    """
+    body = request.get_json(silent=True) or {}
+    source = body.get("source")
+    params = body.get("params")  # may be None
+    try:
+        data, dims = holder.render_source(source, params)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 400
+    except (FileNotFoundError, RuntimeError) as e:
+        return jsonify({"error": str(e)}), 500
+    return _stl_response(data, dims, "rendered.stl")
 
 
 @app.post("/api/holder/cells")