refactor: purge CHandle from module internals (M14 R5)

Module-internal object references are Rust types now (values, Arc,
Mutex); CHandle remains only at the oakengine C-ABI boundary:

- oakundo: the global stack holds UndoStack/UndoCommand values
  directly (stack token is the static's address)
- oaktimeline: marker/workarea boxes carry Arc<Mutex<T>>; commands
  share the same allocation through Arc clones (readers in oakengine
  stubs and the app's graphops updated to lock)
- oaktask/oakstorage: sessions, write-through bindings and the
  database backend pass ProjectArc; the Session drops its manual
  release bookkeeping; nodeutil keeps the CHandle<->Arc boundary
  conversion (release_project restored for the app)
- oakcodec: handle.rs deleted outright (no facade entry needed it);
  texture/block placeholders are unit structs
- oakrender: copier's project handle is an identity u64; alive-count
  machinery removed; handle.rs is make_owned/get/get_mut only
- oakplugin: the instance registry is gone (its unregister key never
  matched, leaking weak entries); handle.rs is the RefBox boundary type
- oaknode/oakcommon: only dead guard/borrow helpers removed; external
  payload handles (texture/processor) documented as the boundary

Flake hunts landed along the way: the audio recording test serializes
on the shared manager lock with a normalized state; the autocacher
cancel test uses a slow producer so cancellation is deterministic.

crates/oakcodec/src/decoder.rs

@@ -32,15 +32,20 @@ use oakcore_rs::{Rational, TimeRange};
 use crate::footagedescription::FootageDescription;
 use crate::frame::Frame;
 
-/// `OakRenderTexture` — refcounted GPU texture handle (an oakrender type,
-/// opaque to oakcodec). The codec crate cannot depend on oakrender (the
-/// dependency cycle), so it only ever produces an empty handle — the
-/// shared [`crate::handle::CHandle`] carries that value unchanged.
-pub type OakRenderTexture = crate::handle::CHandle;
+/// `OakRenderTexture` — GPU texture token (an oakrender type, opaque to
+/// oakcodec). The codec crate cannot depend on oakrender (dependency
+/// cycle), so it never constructs a real texture: [`Decoder::retrieve_video`]
+/// only reports whether the decode succeeded and returns this unit token
+/// (the former empty `CHandle`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct OakRenderTexture;
 
-/// `OakNodeBlock` — opaque node-block handle owned elsewhere; the codec
-/// only stores and forwards it (borrowed, never dereferenced).
-pub type OakNodeBlock = crate::handle::CHandle;
+/// `OakNodeBlock` — opaque timeline-block token owned elsewhere; the codec
+/// only stores and forwards it (borrowed, never dereferenced). No module
+/// ever constructs one (the former `CHandle` was only ever `None`), so the
+/// type is an empty marker kept for API compatibility.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct OakNodeBlock;
 
 /// `oakcodec_video_stream_info` — POD probe output describing one video
 /// stream; see `include/codec/decoder.h`.
@@ -162,8 +167,8 @@ pub enum RetrieveState {
 /// `Decoder::CodecStream` — identifies one (filename, stream) pair plus an
 /// optional associated timeline block.
 ///
-/// The block is an opaque `OakNodeBlock` handle that codec only stores and
-/// compares, never dereferences or retains (borrowed pointer).
+/// The block is an opaque [`OakNodeBlock`] token that codec only stores and
+/// compares, never dereferences or retains (borrowed).
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct CodecStream {
 	filename: String,
@@ -231,8 +236,7 @@ impl CodecStream {
 ///
 /// Implementations are [`crate::ffmpeg::FFmpegDecoder`] and
 /// [`crate::oiio::OIIODecoder`]. The trait surface mirrors the C++
-/// abstract base; the refcounted handle that backs the public API wraps an
-/// `Arc<dyn Decoder>`.
+/// abstract base; the public API hands out `Arc<dyn Decoder>` values.
 pub trait Decoder: Send + Sync {
 	/// Unique decoder id ("ffmpeg"/"oiio").
 	fn id(&self) -> String;