windows: centralise input focus on a single FocusTarget, raise+focus on every window interaction

Focus was scattered across three stores — `Layouts::focus`, `Layers::focus` and `Windows::activated` — plus a hack that smuggled X11 surfaces through `Layers::focus`, with the keyboard target derived each frame from a `layers.focus.or(layout)` precedence. As a result "focused", "activated" and "has the keyboard" could drift apart: a window could be raised without taking the keyboard, the recurring "click a console window, then click it again before you can actually type" symptom.
New `windows/focus.rs` with `FocusTarget { Layout(Weak<Window>), Layer(WlSurface, app_id), X11(WlSurface) }`. `Windows` now holds one `focus_target: Option<FocusTarget>` as the single source of truth; `activated` survives only as a reconciliation cache for the xdg `Activated` state and is never set by hand. `set_focus` takes one `Option<FocusTarget>` and is the only entry point for changing focus: it brings the target to the front (`z_promote` + desktop stacking), refreshes the MRU and stores the target, and keyboard focus plus activation are applied from it on the next `focus()`. `focus()` resolves a baseline (the active layout's window, which carries `Activated`) and an overlay (a focused layer/X11 surface that takes the keyboard over the baseline without de-activating it), mirroring the old precedence but from one field, so keyboard focus follows focus by construction. `Layers::focus` is removed and X11 no longer rides inside it; the exclusive-keyboard layer path and `reap_layer` drive `focus_target` directly, and every click/touch/activation site collapses to `set_focus(Some(FocusTarget::…))`.
surface_at popup tie-break. When a layout hit is a popup or subsurface, its `wl_surface` is not tracked in `toplevel_z_order`, so the layout-vs-X11 z compare resolved to `None` and the X window underneath wrongly won — clicking a GTK menu (e.g. Firefox's) over an X11 window pressed the X window instead of the menu item. The tie-break now compares the owning toplevel's root z, taken from the hit's `FocusTarget::Layout` weak, so the popup's parent stacking decides.
Raise and focus on every window interaction, matching standard desktop behaviour. Client-driven (un)maximize, the SSD maximize/minimize/close buttons and the maximize keybind now bring the window to the front in both the render z-order and the hit-test stacking through a new `raise_toplevel` helper; previously only the stacking was updated, so an unmaximised window could stay visually behind another. Starting a move or resize — including a press on the resize edge — now routes through `set_focus`, so the window comes to the front and takes the keyboard before the drag instead of being resized or moved while it stays behind.
Input robustness around grabs and drags. A press under an active pointer grab (Wayland popup, drag-and-drop or explicit client grab) is routed to the grab instead of forge's own surface_at handling, so a click cannot leak to a window underneath a grabbing popup and a click outside the popup dismisses it cleanly. Only the press is blocked, never the release, so an in-flight move/resize drag or topbar swipe always reaches its end handler and can never stay glued to the cursor if a grab appears mid-gesture. `on_touch_up` now ends any active move/resize drag before its other early-return paths (armed SSD button, topbar swipe, app switcher) and drops a stale armed button, fixing a race where pressing a second, overlapping window left the drag running forever after release.
fix(input): keep the primary touch slot when migrating a drag across surfaces
A touch drag started on an overlay that hides mid-gesture (e.g. the app launcher when dropping an icon onto the dock or the homescreen) froze: it neither moved nor dropped. Destroying the origin surface migrated the drag state (long_press_fired / long_press_origin) and touch_focus to the main surface, but not its primary_touch_id; subsequent touch motion/up events then fell through the auxiliary path and never reached the gesture machine, leaving on_drag_move and on_drop uncalled.
reconcile_overlays and discard_overlay now adopt the destroyed overlay's primary_touch_id when a drag is in flight, so the rest of the touch sequence keeps driving the main surface. Touch-only; the mouse already migrated correctly via pointer_focus.
ltk: add a chassis module for full-screen ambient surfaces
New `src/chassis.rs`, re-exported from the crate root, gathers the scaffolding that every full-screen ambient surface — greeter, lock screen, kiosk — otherwise repeats by hand over the existing theme and `WallpaperBundle` primitives. `set_default_theme(mode)` finds, installs and activates the `default` theme document, returning the failure message instead of exiting so the caller decides how to abort. `theme_logo_rgba(size)` decodes the active theme's horizontal logo to RGBA, and `theme_icon_tinted(name, size, tint)` loads a symbolic theme icon and tints it. `branding_bundle_or_solid(name)` resolves a theme branding image (`"wallpaper"`, `"lockscreen"`, …) to a `WallpaperBundle`, falling back to a solid fill of the palette background when the theme ships none; `wallpaper_bundle_or_solid()` is the `"wallpaper"` convenience. `backdrop(content, &wallpaper, w, h)` stacks content over the wallpaper resolved for the surface size. No new capability — thin convenience over what the theme module and `WallpaperBundle` already expose — but it removes the per-application `load_theme_logo` / `build_wallpaper_bundle` / theme-bootstrap duplication.
ltk: animatable, input-transparent child surfaces via App::subsurfaces()
New `App::subsurfaces() -> Vec<SubsurfaceSpec<Msg>>` (default empty) describes input-transparent child surfaces composited over the main surface, with `SubsurfaceSpec { id, view, x, y, content_version }` and the stable `SubsurfaceId`. The motivating use is a slide/reveal that tracks a finger without the per-frame full-screen CPU re-raster a single-surface opacity or translate would cost: the content buffer is rasterised once and the compositor moves it.
`SubcompositorState` is bound in `event_loop/run.rs` from the compositor's `wl_compositor` (absent → `App::subsurfaces` silently degrades to none); `delegate_subcompositor!` is added on `AppData`, which gains a `subcompositor` binding and a `subsurfaces` map. New `event_loop/subsurface.rs` reconciles the live subsurfaces against the specs: each spec becomes a `wl_subsurface` sized to the main surface with an empty input region, so all pointer/touch falls through to the parent and the host keeps a single gesture/input model. The content — its own SHM pool and `Canvas`, drawn through the existing `DrawCtx` / `layout_and_draw` path — is rasterised only when the surface size or the spec's `content_version` changes; a position-only change emits `wl_subsurface.set_position` and commits the child surface, then a bare parent commit for placement. Committing the child is deliberate: desync subsurface state (the position) is applied on the child surface's own commit, not the parent's, so without it the move is queued but never lands. Positions are given in layout (physical) pixels and divided by the surface scale for the logical `set_position`.
The reconcile pass runs on every run-loop iteration rather than being gated behind a main-surface redraw, so a finger-driven move repositions at input-event rate, decoupled from the frame-callback cadence that paces full redraws — without this the subsurface only moved when the main surface happened to redraw, so a drag over a static background froze the panel in place.

src/app.rs

@@ -118,6 +118,12 @@ impl Anchor
 #[derive( Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord )]
 pub struct OverlayId( pub u32 );
 
+/// Stable identifier for a subsurface, used to diff the list returned by
+/// [`App::subsurfaces`] between frames the same way [`OverlayId`] diffs
+/// overlays.
+#[derive( Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord )]
+pub struct SubsurfaceId( pub u32 );
+
 /// One of the surfaces an [`App`] can target with an invalidation. Used inside
 /// [`InvalidationScope::Only`] to name the affected surfaces.
 #[derive( Debug, Clone, Copy, PartialEq, Eq, Hash )]
@@ -255,6 +261,42 @@ pub struct OverlaySpec<Message: Clone>
 	pub anchor_widget_id: Option<crate::types::WidgetId>,
 }
 
+/// An input-transparent child surface composited over the main surface and
+/// moved by the compositor.
+///
+/// Returned from [`App::subsurfaces`]. The runtime creates one `wl_subsurface`
+/// per active spec, full-size over the main surface, with an **empty input
+/// region** — all pointer/touch falls through to the main surface, so the host
+/// keeps a single input/gesture model. The win is in the move: the content
+/// buffer is rasterised only when [`content_version`](Self::content_version)
+/// (or the surface size) changes, while [`x`](Self::x) / [`y`](Self::y)
+/// changes only emit `wl_subsurface.set_position` + a parent commit — no
+/// re-raster, no buffer re-upload. This makes an animated reveal/slide track
+/// the finger at the compositor's compositing cost rather than the client's
+/// raster cost.
+pub struct SubsurfaceSpec<Message: Clone>
+{
+	/// Stable identifier, used to diff subsurfaces between frames.
+	pub id: SubsurfaceId,
+
+	/// Widget tree for this subsurface. Should paint its own opaque
+	/// background if it must cover the main surface beneath it.
+	pub view: Element<Message>,
+
+	/// Position of the subsurface relative to the parent's top-left, in
+	/// layout (physical) pixels — the same space as [`App::on_resize`] and
+	/// widget rects. The runtime divides by the surface scale to obtain the
+	/// logical position it hands to the compositor. Animate this for a cheap
+	/// compositor-side move.
+	pub x: i32,
+	pub y: i32,
+
+	/// Content revision. Bump it whenever [`view`](Self::view) would paint
+	/// differently; leave it unchanged for position-only updates so the
+	/// runtime skips the re-raster and only repositions.
+	pub content_version: u64,
+}
+
 /// Trait that application types must implement to integrate with ltk.
 pub trait App: 'static
 {
@@ -295,6 +337,12 @@ pub trait App: 'static
 	/// IDs that disappear cause the surface to be destroyed.
 	fn overlays( &self ) -> Vec<OverlaySpec<Self::Message>> { Vec::new() }
 
+	/// Describe the input-transparent child surfaces composited over the main
+	/// surface this frame. Each becomes a `wl_subsurface` the compositor moves
+	/// by position; see [`SubsurfaceSpec`]. Diffed across frames by
+	/// [`SubsurfaceSpec::id`]. Default empty.
+	fn subsurfaces( &self ) -> Vec<SubsurfaceSpec<Self::Message>> { Vec::new() }
+
 	/// Return any pending messages from external sources (timers, async, etc.).
 	fn poll_external( &mut self ) -> Vec<Self::Message> { vec![] }