PSD: a memory budget for one decode and a capped smart-object bake (#1138)

The 2^28 pixel limit applied per image; one composite or layer decode kept
the ZIP output, a Vec<f32> per channel and the result alive together, and the
bake size came from the file's quad. A decode now charges every buffer
against a byte budget (4 GiB, 1 GiB on 32-bit), checks its whole expected peak
before allocating, writes channels straight into the result and returns an
error when over budget. Bakes are at most 4x the document across and 2^24
pixels.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/engine/src/psd_import.rs

@@ -202,7 +202,8 @@ fn smart_object_layer(proj: &mut Project, cx: &mut Ctx, comp: &Comp, index: usiz
         let bb = so.placed_bounds(cw as f64, ch as f64);
         let area = ((bb[2] - bb[0]) * (bb[3] - bb[1])).max(1.0);
         let k = ((cw as f64 * ch as f64) / area).sqrt().clamp(1.0, 4.0);
-        let (w, h) = so.placed_size(cw as f64, ch as f64, k);
+        // At most 4× the document across and 2^24 pixels, however far the file moves a corner.
+        let (k, (w, h)) = so.bake_scale(cw as f64, ch as f64, k, (cx.psd.width, cx.psd.height));
         (w, h, k, bb)
     } else {
         (cw, ch, 1.0, [0.0; 4])