Control channel: a timed-out request is cancelled, and the reply says whether it ran (fixes #345) (#348)

The control server gave up after 60 s with "timeout" but left the request
queued, so the app ran it later and a client retry applied it twice.
Requests now carry a shared state: on timeout the server cancels a request
the app has not started (reply state "not-run", safe to retry) and the app
skips it; one already started replies state "may-have-run". The MCP bridge
passes that on in its error.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

docs/control-protocol.md

@@ -10,6 +10,15 @@ Start the desktop app with `--control PORT` (or `CADCRAFT_CONTROL_PORT=PORT`). I
 
 Errors come back as `{"id": …, "ok": false, "error": "message"}`.
 
+The server waits up to 60 s for the app to answer a request. After that it replies with a timeout, and
+`state` tells whether sending the request again is safe:
+
+- `{"id": …, "ok": false, "error": "timeout", "state": "not-run"}`: the app had not started the request.
+  It is cancelled and will never run, so sending it again is safe.
+- `{"id": …, "ok": false, "error": "timeout", "state": "may-have-run"}`: the app had already started it.
+  It may still finish and change the drawing, and its late result is discarded. Inspect the drawing
+  (`drawing.inspect`) before sending it again.
+
 | Method | Params | What it does |
 |---|---|---|
 | `cmdline.input` | `{text}` | Type a line at the command line exactly like a user. Starts commands by name/alias and answers prompts (points `x,y`, `@dx,dy`, `@d<a`, distances, keywords, empty = Enter). Spaces act as Enter except at text prompts. |