Array API: decide a policy for inherently CPU-only operations

### Background

Several ccdproc operations depend on libraries that are inherently CPU/numpy-only. For non-numpy input they either densify silently (Dask, JAX) or error (CuPy). Affected:

| Function | CPU-only dependency |
|---|---|
| `cosmicray_lacosmic` | astroscrappy (C extension) |
| `wcs_project` | reproject |
| `median_filter`, `background_deviation_filter`, `cosmicray_median` internals, `ccdmask` (non-block branch) | scipy.ndimage |
| `block_reduce`, `block_average`, `block_replicate` | astropy forces `np.asanyarray` on inputs |

### Decision needed

Pick one policy and apply it consistently:

1. **Convert + warn**: explicitly convert to host memory, run the operation, convert the result (data *and* mask/uncertainty) back to the input namespace, and emit a warning the first time.
2. **Raise**: refuse non-numpy input with an informative error telling the user to convert explicitly.

Silent densification is the one unacceptable option (CuPy turns it into a confusing error deep inside the dependency anyway). Whichever policy wins should be documented in `docs/array_api.rst` and reflected in per-backend test markers.

---
Follow-up to #909; relevant to #910 / #912. Found during a review of the array API implementation from #885.

Start with the array API implementation review from #885 and follow-up issues #909, #910, and #912. Review the listed CPU-only functions and `docs/array_api.rst`, then inspect the existing per-backend test markers. Done means a single documented policy is selected and applied consistently, with the documentation and markers updated accordingly.

Written by the indexing model from the issue text.