Guard internal backend APIs

[anirul]

Summary

• add a guarded internal backend header so direct frame/opengl/* and frame/vulkan/* includes fail for user code with an out-of-band message
• move Vulkan window factory registration behind an internal header while keeping CreateNewWindow as the public factory surface
• replace the common-layer Vulkan device downcast with a guarded backend-neutral internal level-data startup interface

Verification

• cmake --build --preset windows-debug --target FrameCommon
• cmake --build --preset windows-debug --target FrameTest FrameJsonTest FrameOpenGLFileTest FrameOpenGLTest FrameVulkanTest
• ctest --test-dir build/windows -C Debug --output-on-failure -R "WindowFactory|ParseLevelTest\.(BuildVulkanLevelFromJson|CreateLevelDataFromPath|CreateLevelDataFromPathVulkan)"
• manual compile guard check for direct frame/vulkan/device.h and frame/opengl/device.h includes without FRAME_INTERNAL_BACKEND_ACCESS