Files render in the browser: STL (and OBJ/GLB) as an interactive 3D view #7335

Blocked by #7330. The owner 3D-prints parts (a vertical hydroponic tower). Clicking an .stl should show the part.

• Vendor three.js at a pinned version with its licence, loaded only on 3D pages, with orbit controls.
• Parse STL in both ASCII and binary forms, plus OBJ, and GLB through GLTFLoader.
• Load from the media route with fetch().
• Auto-fit the camera, use a neutral material with lighting, and add a ground grid.
• Toggles: wireframe and axes.
• The header shows the triangle count and the bounding box in mm (STL units assumed to be mm).
• Without WebGL or JavaScript: a static note plus Download.
• Large files: a size cap, then Download.

Tests:

• The STL parsers on fixtures: an ASCII cube and a binary cube give 12 triangles and a 20×20×20 box.
• The page carries the module script and the media URL.
• The parse runs off the request path, client-side.

Shared rules for every issue in this epic (#7329):

• Each renderer lives in its own file under src/web/render/<kind>.ts and registers itself in the kind registry from #7330. Don't grow src/web/pages/repo.ts. It's a hot file, and five open pulls on it stall the crew.
• No CDN and no remote scripts (the forge CSP). Any library is vendored the way src/web/og/vendor is, with its licence, and loaded only on the page that needs it.
• Repo content never runs as script on the forge origin. Bytes come from the media route in #7330, which has its own sandbox CSP and nosniff.
• Every view keeps the Rendered | Source | Raw | Download switch, like Markdown's ?view=source, so nothing is lost.
• It works at phone width (390 px) and in both themes. Tests cover the HTML shape and the bytes route, not pixels.
• It stays fast: the blob page's existing budget holds. Heavy viewers load their script lazily.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #7391 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Already done on main in 7ae39860b (#10317): src/web/render/model3d.ts, model3d-client.ts, mesh.ts and model-facts.ts render STL (ASCII and binary), OBJ, glTF and GLB with orbit controls, wireframe and axes toggles, triangle count and size, a no-WebGL note with Download, and the three.js vendor with its licence; test/model3d.test.ts covers it. The 3D printing follow-ups (3MF, G-code) are planned fresh from #334.

Replaced by #10892. Everything this issue asked for is on main in 7ae39860b (#10317), and test/model3d.test.ts covers it, so the parked tries had nothing left to land. The fresh issue is the next increment for a person who 3D-prints: .3mf slicer projects in the same view. #10893 (G-code toolpath by layer) follows it.