Thin canvas state, tools menu, and node canvas draw

docs/modernization/roadmap.md

@@ -79,14 +79,14 @@ What is still carrying too much live ownership:
 
 Current hotspot files:
 
-- `src/canvas.cpp`: 4128 lines
-- `src/app_layout.cpp`: 2026 lines
+- `src/canvas.cpp`: 3622 lines
+- `src/app_layout.cpp`: 1498 lines
 - `src/canvas_modes.cpp`: 1798 lines
 - `src/node.cpp`: 1551 lines
 - `src/main.cpp`: 1374 lines
 - `src/node_panel_brush.cpp`: 1197 lines
 - `src/node_stroke_preview.cpp`: 1129 lines
-- `src/node_canvas.cpp`: 962 lines
+- `src/node_canvas.cpp`: 888 lines
 - `src/app.cpp`: 950 lines
 - `src/app_dialogs.cpp`: 908 lines
 
@@ -120,9 +120,14 @@ Current architecture mismatches that must be treated as real blockers:
   merged-texture draw callback plus non-`draw_merged` per-frame layer draw
   callback plus the smoothing-mask face shader/draw pass plus heightmap,
   current-mode, and grid-mode callback setup now routed through the same
-  retained helper family.
+  retained helper family, while post-draw callback assembly and the remaining
+  per-layer render-path orchestration now also route through retained
+  draw-merge helpers even though the broader node draw loop is still inline.
 - `app_layout.cpp` and `app_dialogs.cpp` are still mixed shell/controller files
-  rather than thin composition/binding surfaces.
+  rather than thin composition/binding surfaces, even though tools-menu binding
+  plus nested panels/options submenu wiring now live in
+  `src/app_layout_tools_menu.cpp` and `App::init_menu_tools()` is now a thin
+  call-through.
 - `App`, `Canvas`, `Node`, retained workers, and platform entrypoints still use
   global singleton reach, raw observer pointers, retained static worker
   ownership in several app families, and ad hoc mutex/condition-variable
@@ -145,10 +150,13 @@ Current architecture mismatches that must be treated as real blockers:
   prepared-file worker and the canvas async import/export/save/open worker now
   live under `AppRuntime` instead of retained static app-events/canvas
   workers, `App::rec_loop()` now delegates worker-iteration orchestration into
-  the retained recording bridge, and `App::update_rec_frames()` now delegates
-  recording label refresh through that same retained recording path even though
-  the bridge still owns worker-side readback flow and encoder-state label
-  reads.
+  the retained recording bridge, `App::update_rec_frames()` now delegates
+  recording label refresh through that same retained recording path, and the
+  canvas state-management cluster for picking, clear/clear-all, layer
+  add/remove/order/lookups, animation frame control, resize, and snapshot
+  save/restore now lives in `src/legacy_canvas_state_services.cpp` instead of
+  `src/canvas.cpp`, even though the bridge still owns worker-side readback flow
+  and encoder-state label reads.
 - Modern C++23 usage exists in extracted components, especially `std::span`,
   explicit result/status objects, and a few concepts, but the live app still
   does not consistently express ownership, thread affinity, or renderer