feat: AR Viewer - WebAR with model-viewer, 5 environment presets, placement modes

- Add Google model-viewer 3.5.0 CDN script to client/index.html for WebXR/QuickLook AR
- Create ARViewer.tsx modal component with 5 Japanese environment presets (tatami, modern-japanese, wooden-table, stone-surface, neutral), floor/shelf/wall placement mode selector, WebXR support detection, and small-item scale reference badge
- Replace external AR link in ProductDetail.tsx with in-browser ARViewer modal; auto-detect placement mode from craft_category (textiles=wall, others=floor) and isSmallItem from product dimensions
- Patch GET /api/products/:id to null out ar_model_url when ar_eligible is false, preventing URL exposure for ineligible products

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/products.js

@@ -103,6 +103,11 @@ router.get('/:id', async (req, res) => {
     
     const product = rows[0];
 
+    // Security: do not expose ar_model_url if product is not ar_eligible
+    if (product.ar_eligible === false) {
+      product.ar_model_url = null;
+    }
+
     // Get reviews
     const reviews = await pool.query(
       `SELECT r.*, u.display_name FROM reviews r