holder + scad: SCAD source editor on /holder + new /scad universal renderer

Phase 2 — SCAD editor on /holder
================================
Some adjustments need more control than the parameter form gives
(e.g. tweaking the .scad logic itself). A collapsible CodeMirror-based
editor now slides up from the bottom of the viewport when you click
the "</> Source" button at the bottom-right.

- holder.html / holder.css: editor panel, toggle button, Reset and
  Close buttons. CodeMirror 5 loaded from cdnjs (single CSS + JS
  pair, clike mode for syntax highlighting since OpenSCAD is C-like).
- holder-app.js: lazy-initialises the editor on first show, fetches
  bundled source from /api/holder/source, tracks whether the editor
  content has been modified ("modified" tag in the panel title).
  When the editor is visible AND content differs from bundled,
  _doRender() switches from /api/holder/render -> /api/scad/render
  with {source, params}. Cell-count cap doesn't apply in that mode
  (the source may not even use the holder schema).

Phase 3 — Universal OpenSCAD playground at /scad
================================================
A standalone page for rendering arbitrary OpenSCAD. Paste code, click
Render (or Ctrl+Enter), see STL in the same Three.js viewer the
holder uses. Useful for prototyping new generators before wiring
them into a parameter form.

- New page: static/scad.html + scad.css + js/scad-app.js. Reuses
  holder-viewer.js (the Three.js scene module is generic enough).
- "Load example" populates a 6-hole rounded bracket so new users
  can verify the renderer works in two clicks.
- Same progress UI (elapsed timer + indeterminate bar + Cancel
  via AbortController) as /holder.
- Top nav now has Holder / Busbars / SCAD on every page.

Backend (shared by phase 2 & 3)
================================
- holder.py: split _run_openscad() out of render_stl(). New
  render_source(source, params=None) writes the source to a temp
  file and renders it; enforces MAX_SOURCE_BYTES (default 512 KB)
  and RENDER_TIMEOUT but skips the cell-count cap. New bundled_source()
  returns the hex_cell.scad text for editor pre-population.
- app.py: GET /api/holder/source returns the bundled .scad text.
  POST /api/scad/render takes {source, params?} and returns STL +
  X-Holder-Dimensions header. ValueError -> 400, RuntimeError -> 500.
  _stl_response() factored out so both render endpoints emit the same
  headers consistently.

static/holder.html

@@ -6,6 +6,9 @@
 <title>Hex Holder Designer</title>
 <link rel="stylesheet" href="styles.css" />
 <link rel="stylesheet" href="holder.css" />
+<!-- CodeMirror 5 for the SCAD source editor -->
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.16/codemirror.min.css" />
+<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.16/theme/dracula.min.css" />
 
 <script type="importmap">
 {
@@ -23,6 +26,7 @@
   <nav class="topbar-nav">
     <a href="/holder" class="active">Holder</a>
     <a href="/">Busbars</a>
+    <a href="/scad">SCAD</a>
   </nav>
 
   <span id="status" class="topbar-status">— cells</span>
@@ -89,10 +93,27 @@
     <div class="viewport-overlay">
       <div id="hint-controls">left-drag: rotate · right-drag: pan · wheel: zoom</div>
     </div>
+
+    <!-- Collapsible SCAD source editor (slides up from the bottom of the viewport) -->
+    <div id="scad-panel" class="scad-panel" hidden>
+      <div class="scad-panel-bar">
+        <span class="scad-panel-title">SCAD source <span id="scad-dirty-tag" class="scad-dirty" hidden>· modified</span></span>
+        <button id="btn-scad-reset" type="button" title="Discard edits and reload bundled hex_cell.scad">Reset</button>
+        <button id="btn-scad-close" type="button" title="Hide the editor (changes kept until reload)">Close</button>
+      </div>
+      <div id="scad-editor"></div>
+    </div>
+
+    <button id="btn-scad-toggle" class="scad-toggle" type="button"
+            title="Show / hide the bundled SCAD source. When edits are present, renders use your source instead of the bundled file.">
+      &lt;/&gt; Source
+    </button>
   </section>
 </main>
 
 <script src="js/api.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.16/codemirror.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.65.16/mode/clike/clike.min.js"></script>
 <script type="module" src="js/holder-viewer.js"></script>
 <script type="module" src="js/holder-app.js"></script>
 </body>