feat(charts): add chart creator foundation

[Codewriter90x]

Summary

Adds Chart Creator to the real gameplay flow. A player can import a local WAV
or OGG backing track, enter verified timing metadata, record keyboard/CoreMIDI
hits against the existing DSP clock, review the take against a waveform, edit
individual notes, and export raw or quantized schema-v1 chart data.

The export also produces a portable chart-only .htksong package. Copy that
single file into Documents/HTKSongs on another computer, use Refresh
library, then explicitly bind your own authorized WAV/OGG copy in-game.

Audio authoring flow

• Import audio & create opens the native macOS file picker
• WAV/OGG is copied into a private local folder under Documents/HTKSongs
• title, artist, BPM, bars and beats per bar are explicitly supplied by the user
• unknown timing receives no hidden default
• Gameplay starts with the real DSP audio and an empty schema-v1 timeline
• recorded hits use the existing keyboard/CoreMIDI input and song clock
• saving creates a new locally playable song folder with its own audio copy
• the original selected file is never modified

Waveform and note editor

• builds a bounded 512-point envelope from the already-loaded AudioClip
• supports drag scrubbing, zoom, reset, and audio preview from the playhead
• reuses the existing audio source; no second clock, loader, or timeline
• lists notes in deterministic timeline order
• edits time, drum pad, velocity, and valid pad-specific articulation
• adds missing notes and deletes unwanted notes
• keeps the captured raw take immutable
• disables export when the edited draft is empty
• applies raw, 1/8, or 1/16 export to the edited draft

Schema v1 remains backward compatible: velocity and articulation are
optional. Legacy notes retain unknown velocity and a default articulation
wildcard. Explicit articulations are preserved through JSON load, MIDI mapping,
hit matching, and instructional-kit zone highlighting.

Portable package and local audio binding

Version 1 contains exactly:

• htksong-version
• song.json
• notes.json

Import is fail-closed for unknown entries, audio declarations, symbolic links,
duplicate/case-colliding names, unsupported versions, malformed ZIP/JSON/chart
data, oversized payloads and path traversal. Packages remain in the inbox after
import and refresh is idempotent.

An imported chart awaiting audio exposes Bind local audio. The game confirms
the song and selected basename, copies an authorized WAV/OGG into the direct
user-library song folder, validates it with the production loader, and updates
the manifest atomically. It never modifies the selected source file or portable
package and never persists an absolute machine path.

Architecture

• reuses DspSongClock, HitMatchingPrototype, Song Library, and GameplayPrototype
• records offset-corrected input without a second clock, input stack, or timeline
• maps reduced-speed practice takes back to the original song timeline
• preserves mapped MIDI articulations through the gameplay boundary
• exports atomically to Documents/HTKSongs
• validates generated and rebound manifests/charts with production loaders
• suppresses wrong-hit audio feedback during free chart recording

Content boundary

Portable packages are chart-only. Source audio is never embedded, downloaded,
or redistributed. Local authoring and binding folders may contain the player's
private audio copy; a recipient must supply audio they are entitled to use.

Validation

• build: 0 warnings, 0 errors
• Core: 45/45
• MIDI tool: 39/39
• Unity EditMode: 490/490 (multiple cycles)
• Unity PlayMode: 49/49 (two cycles)
• detached clean checkout: Core 45/45, MIDI 39/39, EditMode 490/490, PlayMode 49/49
• generated Core DLL initially absent in detached checkout
• known Unity first-import normalization remains limited to the two pre-existing URP settings

Current limits

• native audio picker currently targets macOS
• WAV and OGG are supported; MP3 is intentionally rejected
• waveform editing is non-destructive and is not a sample-level audio editor
• .htksong remains deliberately chart-only
• no native file-association/double-click import