fix(imgui): keep the plot inside the child's clip rect and reject unusable input

The widget drew a region derived from the child's content rect alone, so a child
the hosting window cut off cleared and painted over the host's pixels; it also
scaled ImGui's (-FLT_MAX, -FLT_MAX) no-pointer sentinel and differenced it against
the last real position, turning a drag out of the window into a ~1e35 pan, and it
forgot the host's button levels across a re-bind, handing the next plot a press
that never happened.

The region is now the content rect intersected with the child's clip rect (a
no-op when nothing clips it), an invalid position is no position update, and the
button levels survive a re-bind. The controller sanitises non-finite coordinates
and deltas for any host, and the widget's input translation now has a committed
test on the headless EGL context.

include/plot/input/controller.hpp

@@ -58,6 +58,13 @@ class Controller {
   /// refreshes the layout, so gesture geometry and the host agree.
   void set_viewport(Rect px);
 
+  /// Events are sanitised before they are acted on: a non-finite coordinate or
+  /// delta -- a host's "no pointer" sentinel (ImGui reports `-FLT_MAX`), a NaN
+  /// from a degenerate mapping, an infinity from a lost device -- becomes the last
+  /// known position and no movement. Garbage must not reach the ranges: a gesture
+  /// that sets a range also clears auto scale, so a range driven to 1e35 is one the
+  /// user can neither pan nor zoom back. The buttons in the same event are still
+  /// acted on, so a drag whose release arrives with a bad position still ends.
   void on_pointer(const PointerEvent& e);
   void on_wheel(const WheelEvent& e);
   void on_key(const KeyEvent& e);