Add 3D object viewers with r3f stack

Add per-class 3D viewers for tiles, tokens, cards, and custom models
using React Three Fiber, drei, and postprocessing. Viewers are
lazy-loaded and registered through the existing viewer registry, with a
shared scene wrapper for lighting, orbit controls, and subtle effects.

Add a CORS-safe /asset proxy route so three.js loaders can fetch
Workshop-hosted textures and models, and extend TTSObject with the
CustomMesh and CustomTile/CustomToken fields the viewers read.

apps/proxy/src/routes/asset.ts

@@ -0,0 +1,47 @@
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+/**
+ * Fetch an external asset (texture, model, etc.) and stream it back to the
+ * client. Workshop asset hosts (steamusercontent.com, etc.) often omit CORS
+ * headers, which would block `TextureLoader` / `GLTFLoader` in the browser.
+ * Routing through the proxy makes those assets loadable.
+ */
+app.get('/', async (c) => {
+  const raw = c.req.query('url');
+  if (!raw) {
+    return c.json({ error: 'Missing url query param' }, 400);
+  }
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return c.json({ error: 'Invalid url query param' }, 400);
+  }
+  // Only allow http(s) to avoid SSRF via file://, etc.
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return c.json({ error: 'Only http(s) urls are allowed' }, 400);
+  }
+
+  let res: Response;
+  try {
+    res = await fetch(url);
+  } catch (err) {
+    return c.json({ error: `Failed to fetch asset: ${String(err)}` }, 502);
+  }
+  if (!res.ok) {
+    return c.json({ error: `Asset responded ${res.status}` }, 502);
+  }
+
+  const contentType = res.headers.get('content-type') ?? 'application/octet-stream';
+  return new Response(res.body, {
+    headers: {
+      'Content-Type': contentType,
+      'Cache-Control': 'public, max-age=86400',
+    },
+  });
+});
+
+export default app;