feat(viewer): stream live pipeline GLBs into the browser viewport

Protocol: RunSnapshot gains CompletedSteps (accumulated from checkpoint
artifact paths, reset on start) so the frontend can tell when real
pipeline geometry exists. New coordinator method StepArtifact plus
GET /api/artifacts/steps serves steps/*.glb while a run is active (any
lifecycle status), traversal-guarded and .glb-only, so stages appear
without waiting for run completion.

Frontend: GLTFLoader loads the latest completed step into the viewport
group as soon as its checkpoint lands over SSE; replay placeholder
frames render only while no step artifacts exist. ?freeze=1 query param
stops rotation for deterministic screenshot verification. Three.js r160
and GLTFLoader (with BufferGeometryUtils) are vendored under public/
vendor with an import map and a window.THREE shim, replacing the CDN
UMD script; the ~1.4MB vendored three.js files are third-party
dependencies (MIT), not project assets.

Tests: store accumulation of completed artifact paths; steps endpoint
serves GLB during an active run, rejects traversal, 404s missing files.

Verified: dotnet build Debug+Release clean, 42/42 tests pass, Fable
compile clean, release server smoke serves index/vendor/steps endpoint.

1 files changed, 16 insertions, 0 deletions

diff --git a/src/SomhairlesDream.Server/ArtifactRunApi.fs b/src/SomhairlesDream.Server/ArtifactRunApi.fs
index 8d76ffc..8f63b99 100644
--- a/src/SomhairlesDream.Server/ArtifactRunApi.fs
+++ b/src/SomhairlesDream.Server/ArtifactRunApi.fs
@@ -115,6 +115,19 @@ module ArtifactRunApi =
             | Error ArtifactNotFound -> error options 404 "artifact not found"
             | Error(InvalidManifest message) -> error options 500 message
 
+    let private stepArtifact options (context: HttpContext) =
+        match selector context, queryValue context "path" with
+        | Error message, _ -> error options 400 message
+        | _, None -> error options 400 "missing query parameter 'path'"
+        | Ok(projectId, runId), Some relativePath ->
+            match options.Coordinator.StepArtifact(projectId, runId, relativePath) with
+            | Ok path -> Results.File(path, artifactContentType path)
+            | Error RunNotFound -> error options 404 "run not found"
+            | Error(RunNotComplete snapshot) -> jsonWithStatus options 409 snapshot
+            | Error(InvalidArtifactPath message) -> error options 400 message
+            | Error ArtifactNotFound -> error options 404 "artifact not found"
+            | Error(InvalidManifest message) -> error options 500 message
+
     let private writeError options (context: HttpContext) statusCode message =
         task {
             context.Response.StatusCode <- statusCode
@@ -159,3 +172,6 @@ module ArtifactRunApi =
 
         app.MapGet("/api/artifacts/file", Func<HttpContext, IResult>(fun context -> artifact options context))
         |> ignore
+
+        app.MapGet("/api/artifacts/steps", Func<HttpContext, IResult>(fun context -> stepArtifact options context))
+        |> ignore