[boazeggs]

The native app previously displayed one document camera at a time. This change gives model views, route photos, station panoramas, drawings and sheets independent cameras and render state in tiled panes and native satellite windows. Selection, measurements, sources and section geometry remain shared.

Stacked on #53; merge #53 first to keep the integration review separate. Refs #16. This PR implements the pane/window scope below; #16 remains open for verified monitor placement restoration and physical Windows/macOS checks.

• Split and resize panes, move tabs between panes, drag an inactive tab to an edge, and start dragging directly from the original document strip. A document has one owner, empty panes collapse and the model stays open.
• Keep photo decode ownership, camera poses, blend and drawing layer switches per document. Late reads update their requesting pane. Drawing annotations and sheet paper/render caches work in inactive visible panes without copying shared definitions, images or pending jobs.
• Tear tabs off into native windows and dock them back. Handle target motion both before and after the source release, freeze deferred target coordinates and reject stale drag callbacks. Closed windows release their pointer state. Screenshot capture follows the active document window.
• Link individual photo/3D panes with ↔ or set_pane_linked. The scene shows measured photo camera poses; selecting a route-photo or station marker updates a photo in another linked pane while retaining the scene camera and focus. Same-pane selection still opens the photo normally. Split/tear-off operations retain the relevant pane link membership.
• Save source references/transforms/visibility, pane ownership, link flags, document cameras, photo state, drawing layers and shared section through a bounded atomic writer. Startup reopens sources. Invalid/unsupported files are preserved; graceful exit flushes changes.
• Bound GPU viewport slots to eight and share source geometry. API revision 17 adds the documented pane/window/link commands and matching MCP tools, including background-photo document/camera reporting.

Validation:

• 803 native tests passed, 9 explicitly ignored, including all 41 MCP tests and translation checks. Full workspace build and workspace Clippy with --all-targets -- -D warnings passed.
• Actual isolated Wayland input passed initial strip dragging, inactive-tab merging/splitting and native drag-back with one output and two 1280 × 720 outputs. The two-output probe moves the satellite to the second screen and its photo tab back to the first, keeping one owner and its camera.
• Fresh-process restart probes restored model/photo/plan/elevation and A4/A3 sheet layouts, independent cameras, distinct layer switches and annotations, with zero changed pixels in all compared pane interiors.
• Actual link-control clicks and photo following passed: enabling the measured-camera indicator changed 445 model pixels; selecting the other panorama changed 98,111 photo pixels while keeping the scene active and its camera unchanged. Links and both camera renders survived restart with zero changed interior pixels.
• Real BLK2GO station decoding, linked selection and restart passed with the original source SHA-256 unchanged. The camera lies outside this tiny section's indicator comparison region; visible indicator pixels are checked with the synthetic fixture. No real scan data or scan photographs are committed.
• Reproduction scripts, synthetic screenshots and JSON reports are in native/validation/document-panes/.

Current limits:

• Startup docks satellite documents into the main window until their platform monitor identity/placement can be verified. Unsaved point edits remain outside this layout file (SuperCloud: bestanden uit Docs openen en de assistent (MCP) aansluiten #52).
• The cross-window proof uses Wayland focus/motion transitions, with release and stationary motion in one test input frame. Physical Windows/macOS multi-monitor validation remains open.