feat: add HWPX fragment paste support

[dragonnite1221-lgtm]

Adds HWPX fragment paste support, WASM bridge APIs, rhwp-studio insertion UI, bundled example yangsik fragments, and regression tests.

This is a follow-up to closed PR #880 and addresses the review feedback there.

Architecture note

This PR intentionally keeps two paste boundaries because they serve different safety contracts.

• pasteHwpxFragmentRaw / fragment_paste.rs is the raw XML primitive. It performs byte-preserving section/header edits and owns HWPX ID remapping for raw snippets.
• pasteHwpxFragmentInDocument / fragment_paste_in_document.rs is the editor-facing bridge. It reuses the raw XML primitive, then reparses the updated section back into DocumentCore so rendering and later edit commands stay in sync.
• cross_document_migrate.rs is the IR migration primitive for future structured cross-document copy/paste. It stays separate from the raw HWPX fragment path because it operates on Document/DocInfo IR, not byte-preserved HWPX XML. The convergence point is the command/API layer: raw HWPX fragments use the byte-preserving path now; structured IR copy/paste can use the migration primitive when that workflow is exposed.

Review follow-up

• Rebased onto current origin/devel.
• Removed the as any call by using the generated WASM binding type for pasteHwpxFragmentInDocument.
• Removed local-machine yangsik smoke tests and kept self-contained bridge tests using saved/04-blank_hwpx_empty.hwpx.
• Aligned blank HWPX seed comments with saved/04-blank_hwpx_empty.hwpx.
• Removed the unused build_occupied_sets helper.
• Added bundled example fragments under rhwp-studio/public/yangsik-fragments/ so the dialog is non-empty and end-to-end testable by maintainers.
• Gated the 양식 부품 command to HWPX documents; HWP5 documents do not expose this unsupported XML-fragment operation.
• Hardened the fragment catalog endpoint against traversal, double-encoded path traversal, symlinks, writable catalog files, TOCTOU reads, and oversized manifest/fragment files.

Validation

• cargo test --test fragment_paste_integration --test fragment_paste_in_document
• cargo test fragment_paste
• cd rhwp-studio && npm run build
• gitleaks detect --source . --log-opts origin/devel..HEAD --redact --no-banner --verbose
• Dev endpoint smoke check:
  • manifest returns bundled entries
  • basic-two-cell-table.xml returns 200
  • encoded traversal probe returns 404
• Codex second-review gate: clean via gemini-oauth, risk=medium