refactor: purge CHandle from module internals (M14 R5)

Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:

- oakundo: the global stack holds UndoStack/UndoCommand values
  directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
  share the same allocation through Arc clones (readers in oakengine
  stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
  database backend pass ProjectArc; the Session drops its manual
  release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
  conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
  texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
  machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
  matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
  payload handles (texture/processor) documented as the boundary

Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.

crates/oakaudio/src/lib.rs

@@ -20,12 +20,12 @@
 //! (`include/audio/*.h`). See README.md for the architectural mapping
 //! (singleton manager, stateless sync helpers, local value types).
 //!
-//! ## FFI discipline
+//! ## Structure
 //!
-//! Identical to the oaknode crate: every export goes through
-//! [`handle::guard*`], handles are opaque refcounted boxes (or, for the
-//! singleton `AudioManager`, borrow-only no-ops), shared state behind
-//! `Mutex`.
+//! Single-lib unification: the module crates are called directly from the
+//! oakengine facade (`crates/oakengine`), which owns the C-ABI shims and
+//! boxes the singleton [`manager::ManagerInner`] behind its own `CHandle`.
+//! Shared state lives behind `Mutex`.
 
 #![deny(unsafe_op_in_unsafe_fn)]
 #![warn(missing_docs)]