fix(plot,figure): re-index hot region, logical row floor, refuse live on a linked axis

Three smaller findings at the plot/figure seam:

* `Plot::remove_region()` re-indexed `region_stats_` but left `hot_.region`
  naming the old index, so a frame after a removal highlighted the wrong
  region's bound and an open drag edited a different region. The published
  handle (and its zone) is now cleared or decremented with the cache, and the
  contract documents that a host must not remove a region mid-drag.

* `Figure`'s `kMinRowHeightPx` was applied as a *device*-pixel floor while
  chrome is logical, so at 2x the guarantee was half as strong exactly where
  the chrome is twice as large. It is now a logical constant converted through
  the row's own `ui_scale()`, 1:1 for a non-positive scale as `Style::device()`
  does.

* `Figure::link_x()` refused a member whose axis 0 was `XFollow::Live`, but
  nothing refused `set_x_follow(0u, XFollow::Live)` *after* linking. The group
  then wrote its range into an axis that reinterpreted it against its own live
  edge, read it back as an external change, and tracked one member instead of
  the union. `Plot` now carries a linkage flag (`set_x_link_member()`), set by
  `link_x()` and cleared by `unlink_row()`, and `set_x_follow()` refuses `Live`
  on a linked axis.

Tests: arming `Live` on a linked member leaves it `Off` and unlinking restores
the ability to arm it; the row-height floor is 24 and 48 device pixels at 1x
and 2x respectively.

src/plot/plot.cpp

@@ -394,6 +394,13 @@ void Plot::set_y_auto_scale(u32 axis, bool on) {
 
 void Plot::set_x_follow(u32 axis, XFollow f) {
   if (axis >= x_axes_.size()) return;
+  // A figure link group owns this axis' shared window *and* its follow state:
+  // `Figure::link_x()` refuses a `Live` member joiner, and arming `Live` here *after*
+  // linking would be the same state reached by the back door -- `push_link()` would
+  // write the group's range into an axis that reinterprets it against its own live
+  // edge, `adopt_member_changes()` would read it straight back as an external change,
+  // and the group would track one member instead of the union of them. Refused.
+  if (f == XFollow::Live && x_axes_[axis].link_member) return;
   x_axes_[axis].follow = f;
   // Arming a live axis places its window at once, so x_range() reports the window
   // the next layout produces rather than the one the axis held while it was Off.
@@ -402,6 +409,11 @@ void Plot::set_x_follow(u32 axis, XFollow f) {
   place_live_x_window(axis);
 }
 
+void Plot::set_x_link_member(u32 axis, bool linked) noexcept {
+  if (axis >= x_axes_.size()) return;
+  x_axes_[axis].link_member = linked;
+}
+
 XFollow Plot::x_follow(u32 axis) const {
   return axis < x_axes_.size() ? x_axes_[axis].follow : XFollow::Off;
 }
@@ -706,6 +718,24 @@ void Plot::snap_region(u32 id) {
 void Plot::remove_region(u32 id) {
   if (id >= regions_.size()) return;
   regions_.erase(regions_.begin() + static_cast<std::ptrdiff_t>(id));
+  // The published hot handles name a region by index and are re-indexed with everything
+  // else: the removed region's own handle is cleared (nothing is hot there any more, and a
+  // frame drawn before the next event would otherwise highlight the region that slid into
+  // its slot), and a handle naming a region above the hole follows it down. The `zone` is
+  // the grab that went with that index, so it is cleared with it -- a stale zone describing
+  // a region that is no longer there would colour the next region's bound.
+  //
+  // A host must not remove a region *mid-drag*: the controller holds the id it grabbed, and
+  // this setter cannot re-index a controller's private `drag_region_`. The gesture's release
+  // would then edit whichever region now carries that id. Remove regions between gestures.
+  if (hot_.region != kInvalid) {
+    if (hot_.region == id) {
+      hot_.region = kInvalid;
+      hot_.zone = RegionGrab::None;
+    } else if (hot_.region > id) {
+      hot_.region -= 1u;
+    }
+  }
   // The cache is keyed by region index, so the removed region's entries name nothing
   // and every entry above the hole names a region one slot further down. The
   // surviving regions' own intervals are untouched -- erase keeps their order -- so