* paint: refuse a sequential-dab stroke whose working copy is too large
apply_dab_stroke read the whole rectangle enclosing a stroke's dabs into
two dense f32 copies (and a third for the mix), sized by the area
between the dabs rather than what they paint. Two distant points asked
for gigabytes on a sparse document.
Check the three planes against a 4 GiB budget (1 GiB on 32-bit) before
reading, and paint nothing past it.
* address review: apply_dab_stroke returns Result so over-budget dab strokes fail with 'stroke too large'
* fix tests: apply_dab_stroke returns a Result
* fix tests: handle the Result of the dab-stroke functions