Support filtering toCompositeImage() to a subset of layers

[philips-clanker]

Summary

Fixes #35. toCompositeImage() previously always flattened every surface in the file. The Obsidian plugin's .spd viewer wants a per-layer visibility toggle (philips/supernote-obsidian-plugin#138), which needs compositing only a chosen subset of surfaces on each re-render instead of always all of them.

async toCompositeImage(visibleSurfaces?: Iterable<IAtelierSurfaceName>): Promise<Image | null>

• undefined (the default) keeps existing behavior — every surface, via _compositeOrder().
• When given, _compositeOrder()'s result is filtered down to just the requested surface names before compositing, so the bottom-to-top layers-based stacking order is unchanged — only which surfaces participate changes.
• Surface names not present in the file are silently ignored, matching toImage()'s existing behavior for an unknown surface name.
• An empty/all-excluded set (or a file with no tiles at all) returns null, same as the no-tiles case already did.

Test plan

• npm run build (tsc) succeeds
• npm run lint passes
• npm test — full suite passes (39/39)
• New tests against tests/input/real-device.spd (per the issue's request):
  • Compositing just ['surface_1', 'surface_2'] (hiding the surface_9999 "Reference Layer" background) produces an image still sized/aligned to the full file, but transparent where only the background would have shown, while the full composite is opaque there.
  • Empty subset, and a subset of only a tile-less surface, both return null.
  • A subset naming a nonexistent surface alongside a real one still composites the real one.
• Visually inspected the "hide background" composite — shows only the two sketch layers on a transparent canvas, background fully excluded