feat: preflight validation support for model conversions

[Hacks4Snacks]

Summary

Add shared model preflight and import diagnostics across CLI, HTTP API,
MCP, WASM, and Studio.

Previously, malformed input could silently lose flows, receive replacement
identities, or discard misspelled manifest fields. Conversions could also
remove important model information without warning. This change reports
those conditions before importing or writing output.

Preflight validates document integrity and known format limitations.
It does not evaluate security rules, repair models, or change threat triage.

Changes

• Return structured diagnostics with stable codes, severity, source paths,
  and actionable messages.
• Validate canonical JSON before reconstruction, rejecting duplicate
  fields and identities, unsupported kinds, invalid sizes, and unresolved
  or cross-page flow endpoints.
• Reject unknown manifest fields, including properties instead of
  props, even when --force is specified.
• Harden draw.io and Visio imports against malformed graphs and report
  omitted or inferred content.
• Add tmforge preflight, /v1/model/preflight, the WASM export, and a
  sandboxed MCP preflight tool.
• Preview known conversion losses involving threat registers, properties,
  identities, metadata, knowledge bases, and coordinate translation.
• Run CLI conversion preflight before opening the destination; add
  --fail-on-loss to reject warnings without modifying existing output.
• Add Studio import/export review: errors block; warnings require
  Continue or Cancel. Reject stale results after workspace edits.

No new dependencies or separate analysis pipeline are introduced.

Compatibility and Limits

• Canonical JSON extension fields remain readable with warnings.
  Custom property bags, Studio view fields, and expected pack fingerprints
  remain recognized.
• Legacy manifests remain supported when explicitly selected.
• New Studio imports require the API or WASM engine; offline authoring
  and saving the current JSON workspace remain available.
• Preflight input is limited to 8 MiB, JSON depth to 64, and diagnostics
  to 100. Exhausting the diagnostic budget produces a blocking error.
• Conversion warnings describe known losses, not guaranteed lossless
  interoperability or validation by the destination product.