feat: add session recording and replay for interactive event exploration

[rx18-eng]

Body

adds session recording + replay for #883. depends on #835 (the event bus), built on that branch.

record an exploration (camera moves + bus events like particle tagging), replay it as live interactive 3D, not a video. share as a URL or a .phnxreplay file.

how it works

• SessionRecorder listens on the event bus (new onAny wildcard) + samples the camera every 100ms
• SessionPlayer re-emits the events at original timing, so the replay stays interactive (pause, rotate, scrub, 0.5x-4x)
• serialized with deflate + base64, same as the share-link state param
• no new toolbar icon. a floating pill shows only while recording/replaying. Shift+Ctrl+R toggles recording

triggers

• Shift+Ctrl+R to record
• ?replay=<base64> inline link
• ?session=<url> remote .phnxreplay file

shared links do NOT auto-play. they decode + validate, then the pill shows:

Shared session, from <host>, [Play]

and waits for an explicit click before replaying.

security

• ?session= fetch: http/https only, credentials omitted, no-referrer, 15s timeout, streamed 10MB size cap (aborts mid-download)
• ?replay= decode: 50MB decompression-bomb cap, schema validation, malformed input fails safe
• recorder auto-stops at 50k events / 60 min
• no innerHTML / eval anywhere; replayed payloads go through the normal event bus

not in this PR

• live co-viewing
• a file-upload button to re-load a downloaded .phnxreplay (currently re-loaded via ?session= URL)

tested

• 275 + 186 unit/component tests (recorder, player, codec, pending flow, fetch hardening)
• live record -> share -> replay
• camera-path replay verified in the browser

Recording.2026-06-06.172804.1.1.mp4

[rx18-eng]

@EdwardMoyse @sponce had been working on this sice the last month and have finally implemented it , let me know your thoughts !

[sponce]

Looks great ! A very nice alternative to fat videos recorded from the screen. I like it a lot

[rx18-eng]

@sponce thanks for your review :)