Extend C API with component-level access functions + memory bug fixes

[paul-krug]

Adds C-API surface for component-level access to the backend, plus
three pre-existing memory/correctness bug fixes found along the way.
Structured as three commits — easiest reviewed commit-by-commit.

Commit 1 — correctness fixes (small, ~20 lines)

• Tube::operator= copied the 93 sections plus three scalars but
  silently dropped staticPartsInitialized, the subglottal/nasal
  cavity lengths and both piriform fossa dimensions, so a copied
  Tube could disagree with the original on static geometry.
• vtlGetTransferFunction: the fallback TransferFunctionOptions
  was declared inside the if (opts == NULL) block but used through
  the opts pointer after the block ended (dangling pointer; under
  -O3 the stack slot was reused, corrupting the options). Also
  opts->staticPressureDrops was never copied into TlModel::Options,
  so that option was silently ignored.

Commit 2 — new C-API surface (the bulk; mechanical)

21 new vtl* functions exposing backend internals for component-level
use from language bindings (driving individual models step by step,
reading intermediate values) without full synthesis runs:

• Glottis: vtlGlottisCalcGeometry, vtlGlottisIncTime,
  vtlGlottisResetMotion, vtlGetGlottisStaticParamInfo (also added
  to the Windows export table).
• Time-domain simulation on a caller-supplied tube:
  vtlTdsSetTubeAndRun, vtlTdsSetOptions, vtlTdsResetMotion.
• Anatomy scaling: vtlGetAnatomyParams, vtlSetAnatomyParams,
  vtlSetAnatomyFromAge, vtlSetFossaDims.
• Geometry export: vtlGetSurfaceVertices, vtlGetCenterline,
  vtlGetOutlines, vtlGetCrossSections, vtlGetCuts,
  vtlGetProfiles, vtlGetTongueRibData, vtlGetTongueWidthBounds,
  vtlTractToFullTube.
• TL introspection: vtlGetTLIntermediateValues, backed by new
  read-only TlModel accessors (getMatrixProduct,
  getFossaInputImpedance, getNose-/getMouthRadiationImpedance).

Supporting changes: VocalTract::getRawCuts(), the outline line
strips made public, 4 entries in the Windows export table.

This commit also folds in one small correctness fix (bundled here
because it's consumed by the new vtlTractToFullTube):
Tube::getVelumOpening_cm2() returned noseSection[0].area_cm2 — the
nose-section area after shaping and the MIN_AREA_CM2 clamp —
instead of the velopharyngeal opening the caller requested. It now
returns that raw value, stored in a new rawVelumOpening_cm2 member
set in setVelumOpening() (and copied in operator=). The two agree
for any normally-open velum and differ only at/near a closed port —
e.g. a requested opening of 0.0 previously read back as 0.0001
(the clamp floor), now reads back as 0.0. Affected readers: the
velumOpening_cm2 output of vtlTractToTube / vtlFastTractToTube /
vtlTractToFullTube, tube interpolation, and the Synthesizer text
export.

Commit 3 — off-by-one array overruns found with AddressSanitizer

• AnatomyParams::adaptArticulation() scaled four tongue-side
  params but the model has three (TS1..TS3); TS1+3 == NUM_PARAMS,
  so the loop read and wrote one element past the oldParams/
  newParams stack arrays per call. The stray write can crash the
  process later (malloc abort in ~VocalTract() during vtlClose()
  after using the anatomy API, depending on stack layout). Loop bound
  is now derived from the enum.
• VocalTract::calcTongueRibs() right-edge scan started at
  k = NUM_PROFILE_SAMPLES, reading upperProfile/lowerProfile one
  element past the end (read-only; rejected by the INVALID guards in
  the normal case → no behavior change expected). Now starts at the
  last valid index.

Testing

Builds clean on macOS arm64 (cmake Release). VtlApiTests 19/19 and
VtlBackendTests 1/1 pass. Each commit compiles standalone; new API
paths exercised under AddressSanitizer.

Known pre-existing issue (NOT addressed here, for the record)

AddressSanitizer shows EmaPoint::name strings sharing buffers with
XML-parser strings freed at the end of VocalTract::init()
(XmlNode.cpp); using the anatomy API then makes vtlClose()
double-free, so a process can abort at exit (work/results unaffected).
Pre-dates this PR (reproduces on current main + these additions) and
lives in the XML/EMA ownership code — worth its own issue/fix.