feat(viewer): stream live pipeline GLBs into the browser viewport

Protocol: RunSnapshot gains CompletedSteps (accumulated from checkpoint
artifact paths, reset on start) so the frontend can tell when real
pipeline geometry exists. New coordinator method StepArtifact plus
GET /api/artifacts/steps serves steps/*.glb while a run is active (any
lifecycle status), traversal-guarded and .glb-only, so stages appear
without waiting for run completion.

Frontend: GLTFLoader loads the latest completed step into the viewport
group as soon as its checkpoint lands over SSE; replay placeholder
frames render only while no step artifacts exist. ?freeze=1 query param
stops rotation for deterministic screenshot verification. Three.js r160
and GLTFLoader (with BufferGeometryUtils) are vendored under public/
vendor with an import map and a window.THREE shim, replacing the CDN
UMD script; the ~1.4MB vendored three.js files are third-party
dependencies (MIT), not project assets.

Tests: store accumulation of completed artifact paths; steps endpoint
serves GLB during an active run, rejects traversal, 404s missing files.

Verified: dotnet build Debug+Release clean, 42/42 tests pass, Fable
compile clean, release server smoke serves index/vendor/steps endpoint.

2 files changed, 95 insertions, 0 deletions

diff --git a/tests/SomhairlesDream.Server.Tests/ApiTests.fs b/tests/SomhairlesDream.Server.Tests/ApiTests.fs
index cc8a3da..f51ca3d 100644
--- a/tests/SomhairlesDream.Server.Tests/ApiTests.fs
+++ b/tests/SomhairlesDream.Server.Tests/ApiTests.fs
@@ -53,6 +53,14 @@ type private BlockingBridge(gate: ManualResetEventSlim) =
             gate.Wait()
             (TestBridge() :> IArtifactBridge).Export(request, fun () -> ())
 
+type private StepGatedBridge(gate: ManualResetEventSlim) =
+    interface IArtifactBridge with
+        member _.Export(request, _) =
+            if request.Step.Index > 0 then
+                gate.Wait()
+
+            (TestBridge() :> IArtifactBridge).Export(request, fun () -> ())
+
 let private requestBody runId =
     $"{{\"projectId\":\"{ids.ProjectId}\",\"runId\":\"{runId}\",\"baseId\":\"{ids.BaseId}\",\"targetId\":\"{ids.TargetId}\"}}"
 
@@ -204,6 +212,61 @@ let ``manifest endpoint reports active runs as conflicts`` () =
         gate.Dispose()
 
 [<Fact>]
+let ``step artifacts stream while a run is still active`` () =
+    let gate = new ManualResetEventSlim(false)
+
+    try
+        withAppUsing
+            (fun () -> StepGatedBridge(gate) :> IArtifactBridge)
+            (fun client coordinator ->
+                let runId = "run-api-steps"
+                use content = new StringContent(requestBody runId, Encoding.UTF8, "application/json")
+                let start = client.PostAsync("/api/runs/start", content).GetAwaiter().GetResult()
+                Assert.Equal(HttpStatusCode.Accepted, start.StatusCode)
+
+                Assert.True(
+                    waitFor (fun () ->
+                        coordinator.TryFind(ids.ProjectId, runId)
+                        |> Option.exists (fun store ->
+                            let snapshot = store.Snapshot()
+                            snapshot.Status = "running" && snapshot.CompletedSteps.Length = 1)))
+
+                let glbPath = Uri.EscapeDataString("steps/01-foundation.glb")
+                let stepsUrl = $"/api/artifacts/steps?projectId={ids.ProjectId}&runId={runId}&path={glbPath}"
+
+                let stepArtifact =
+                    client.GetAsync(stepsUrl).GetAwaiter().GetResult()
+
+                Assert.Equal(HttpStatusCode.OK, stepArtifact.StatusCode)
+                Assert.Equal("model/gltf-binary", stepArtifact.Content.Headers.ContentType.MediaType)
+
+                let traversalPath = Uri.EscapeDataString("../manifest.json")
+                let traversalUrl = $"/api/artifacts/steps?projectId={ids.ProjectId}&runId={runId}&path={traversalPath}"
+
+                let traversal =
+                    client.GetAsync(traversalUrl).GetAwaiter().GetResult()
+
+                Assert.Equal(HttpStatusCode.BadRequest, traversal.StatusCode)
+
+                let missingPath = Uri.EscapeDataString("steps/03-cabin.glb")
+                let missingUrl = $"/api/artifacts/steps?projectId={ids.ProjectId}&runId={runId}&path={missingPath}"
+
+                let missing =
+                    client.GetAsync(missingUrl).GetAwaiter().GetResult()
+
+                Assert.Equal(HttpStatusCode.NotFound, missing.StatusCode)
+                gate.Set()
+
+                Assert.True(
+                    waitFor (fun () ->
+                        coordinator.TryFind(ids.ProjectId, runId)
+                        |> Option.exists (fun store -> store.Snapshot().Status = "complete")))
+            )
+    finally
+        gate.Set()
+        gate.Dispose()
+
+[<Fact>]
 let ``events endpoint streams only the selected run`` () =
     withApp (fun client _ ->
         let runId = "run-api-events"
diff --git a/tests/SomhairlesDream.Server.Tests/StoreTests.fs b/tests/SomhairlesDream.Server.Tests/StoreTests.fs
index 4aec16f..5ef2cba 100644
--- a/tests/SomhairlesDream.Server.Tests/StoreTests.fs
+++ b/tests/SomhairlesDream.Server.Tests/StoreTests.fs
@@ -90,6 +90,38 @@ module StoreTests =
         Assert.False(snapshot.IsStale)
 
     [<Fact>]
+    let ``artifact store accumulates completed step artifact paths`` () =
+        let store = ArtifactRunStore(artifactIds, TimeSpan.FromSeconds 15., at 9)
+
+        store.Apply(
+            RunEvent.Start
+                { Ids = artifactIds
+                  At = at 9
+                  TotalSteps = 2 }
+        )
+        |> ignore
+
+        Assert.Empty(store.Snapshot().CompletedSteps)
+
+        for index, stepId in [| 0, "01-foundation"; 1, "02-frame" |] do
+            store.Apply(
+                RunEvent.Checkpoint
+                    { Ids = artifactIds
+                      At = at 9
+                      StepId = stepId
+                      StepIndex = index
+                      TotalSteps = 2
+                      Message = "artifact verified"
+                      ArtifactPath = $"steps/{stepId}.glb" }
+            )
+            |> ignore
+
+        Assert.Equal<string array>(
+            [| "steps/01-foundation.glb"; "steps/02-frame.glb" |],
+            store.Snapshot().CompletedSteps
+        )
+
+    [<Fact>]
     let ``artifact store derives staleness without changing lifecycle status`` () =
         let store = ArtifactRunStore(artifactIds, TimeSpan.FromSeconds 15., at 9)