Web: opt-in embedding bridge for host pages (?host=parent)

[CyberFox-81]

A page that frames EffectCraft on the same origin can now open footage and projects in it and store what it saves and renders, through postMessage, instead of saved projects and Render Queue outputs becoming browser downloads. Built for a Nextcloud integration, but nothing in it is host-specific.

Only the web shell changes (src/host.rs):

• effectcraft:open { name, path, blob } from the parent: the file is put in the file table under /host plus the parent's path (unpersisted) and opened or imported as a picked file is
• before a project opens, footage it refers to under /host that isn't here yet is asked of the parent (effectcraft:need { paths }) and arrives as effectcraft:file { path, blob }
• files::deliver sends what would be downloaded (saved projects, renders) to the parent (effectcraft:save): a file under /host by the parent's path, anything else by its file name
• effectcraft:dirty reports unsaved changes; effectcraft:ready and effectcraft:failed report start-up. In host mode the last session, the demo and the recovery offer don't open, and the session isn't kept in browser storage.

Enabled only by ?host=parent inside a frame; only the parent window on the page's own origin is heard or answered. Without it nothing changes.