feat: gate muda dep + menu API behind menus feature (default on)

[mxaddict]

Closes #1076.

Summary

Adds a menus Cargo feature that gates the muda dependency and all
menu-related API. The feature is in default = [...], so existing
apps are unaffected. Consumers that don't render menu bars
(layer-shell overlays, tray apps, single-window utilities) can opt
out with default-features = false and skip the gtk-rs / glib-sys /
gettext-sys cascade on Linux.

# consumer Cargo.toml — no menus, no gtk-rs:
floem = { version = "...", default-features = false, features = [
  "default-image-formats", "vger", "serde", "editor",
] }

Why

On Linux, floem unconditionally pulls muda with the gtk
feature, which drags in ~30 gtk-rs sys crates and gettext-sys. For
apps that never open a menu bar this is pure overhead with two
concrete costs:

• Cross-compile pain. arm64 / musl targets need a properly
  multiarch'd or sysroot'd glib build — currently a hand-rolled apt
  source-list dance or a cross-rs/cross container.
• Unmaintained-advisory noise. The gtk-rs GTK3 bindings family
  has been deprecated upstream (RUSTSEC-2024-0412/0413/0415/0416/0418/0419/0420)
  plus proc-macro-error (RUSTSEC-2024-0370). Every downstream has
  to ignore these advisories with rationale.

What changed

• Cargo.toml — menus = ["dep:muda"] feature; added to
  default; muda workspace dep + target-specific entries marked
  optional = true.
• src/ — every use muda::* / pub use muda / muda::* call
  site cfg-gated with #[cfg(feature = "menus")]. Touched
  lib.rs, action.rs, message.rs, context.rs, app/{mod,handle}.rs,
  window/{handle,state}.rs, view/{id,state}.rs, views/decorator.rs,
  event/dispatch.rs, platform/mod.rs.
• No new abstractions, no no-op shims — menu symbols are fully
  absent off-feature. Consumers see the missing API at compile time
  if they call into it.

Verification

# menus OFF — no muda in dep tree
cargo build -p floem --no-default-features \
  --features default-image-formats,vger,serde,editor
find target/debug/deps -name 'libmuda*' -o -name 'libgtk*' -o -name 'libglib_sys*'
# → 0 matches

# menus ON (default) — muda compiles normally
cargo build -p floem
find target/debug/deps -name 'libmuda*'
# → libmuda-*.rlib + .rmeta present

cargo check -p floem --features menus       # clean
cargo build -p floem --all-features         # clean

Notes

• One side cleanup: the original Cargo.toml had muda = { workspace = true } in a windows+macos target block AND muda = { workspace = true, default-features = false, features = ["gtk"] } in a Linux
  target block. The windows+macos block was redundant once the
  workspace optional = true was set, so it collapses to a single
  general muda = { workspace = true, optional = true } plus the
  Linux-specific gtk-feature override. Cargo's merge of the two
  entries preserves the original per-OS feature set.
• cargo fmt is broken project-wide for this checkout (existing
  let-chains in dispatch.rs/handle.rs aren't parsed by stable or
  nightly rustfmt). Touched files match the surrounding style; no
  blanket reformat was applied.

Test plan

• cargo build -p floem --no-default-features --features default-image-formats,vger,serde,editor — clean, zero muda/gtk artifacts.
• cargo check -p floem (default features) — clean.
• cargo check -p floem --features menus — clean.
• cargo build -p floem --all-features — clean.
• CI matrix runs (deferred to PR CI).