Cap the tilt thrust_command_from_acceleration asks for

[naseem173]

Fixes #293.

A position loop with a distant setpoint, or one that has wound up, can ask thrust_command_from_acceleration for a lateral acceleration large enough to tip the body past where its vertical thrust still holds it up, so it descends while accelerating sideways instead of climbing or holding height.

This adds thrust_command_from_acceleration_with_tilt_limit, which behaves the same as thrust_command_from_acceleration but caps how far from level the attitude is allowed to lean (an angle in (0, pi/2) measured from +z). When the wanted acceleration would tip the body past that cap, the sideways part of the push is scaled down to fit while the vertical part is left exactly as it was, so the requested climb or descent rate is preserved. A new ThrustCommand::tilt_bound() accessor reports whether the cap was hit, following the same pattern as RotorCommands::saturated() elsewhere in the crate.

Changes:

• ControlError::InvalidTiltLimit for a max_tilt that isn't strictly positive or reaches/exceeds a quarter turn.
• thrust_command_from_acceleration_with_tilt_limit in control/thrust_command.rs, with a doctest.
• ThrustCommand::tilt_bound() accessor.
• Re-exports in control/mod.rs and lib.rs.
• Six new tests covering: an unchanged modest request, a large request capped with vertical preserved, direction preservation while capping, undefined-direction errors still surfacing through the new entry point, and rejection of invalid/non-finite tilt limits.

Verified locally: cargo test -p multicalc, cargo test -p multicalc --features alloc, cargo test -p multicalc --all-features --doc, cargo fmt --all --check, cargo clippy -p multicalc --all-targets --features alloc -- -D warnings, and cargo doc -p multicalc --no-deps --all-features all pass.

• cargo test + cargo clippy --all-targets clean
• cargo fmt
• doctests pass (cargo test --doc)