Cover every output from a background shell: the session-lock secondary machinery generalizes to layer surfaces

The runtime already covered outputs beyond the first, but only for `ShellMode::SessionLock`: `locked` created one `ext-session-lock` surface per output, tracked in `lock_extras`, rendered from `App::lock_secondary_view`, excluded from pointer/touch routing and repainted through the shared invalidation path. A background shell had nothing equivalent, so on a multi-monitor session its wallpaper simply did not exist on the extended screens — the compositor had to fake one by cover-scaling the primary's background, wrong scale and wrong crop included.
The machinery is shared rather than duplicated. The state and the hook lose their lock-specific names — `lock_extras` becomes `secondaries`, `main_lock_output` becomes `main_output`, `App::lock_secondary_view` becomes `App::secondary_view` — and everything downstream of creation (the draw loop in frame.rs, invalidation, per-surface scale handling, the input exclusion in pointer/touch, redraw scheduling in run.rs) is the same single copy serving both kinds.
What is genuinely new is the second creation site: in `new_output`, when the app's shell mode is `Layer( Background )`, every output beyond the main surface's gets its own background layer surface — anchored to all four edges with size delegated to the compositor, exclusive zone 0, no keyboard interactivity — bound to that output at creation and torn down in `output_destroyed`. The main surface's output is now recorded when it materializes so the runtime knows which output not to cover.
Layer-shell events learn about secondaries too, and the `configure` branch is not optional: secondaries live outside the focus map, so their configure used to fall into the `None` arm and resize the main surface. `closed` on a secondary now just drops it instead of asking the app to exit.
`secondary_view` keeps its default of `None` (surface filled with `background_color`), so nothing changes for apps that do not opt in; the session-lock behaviour is unchanged aside from the renames.

src/app.rs

@@ -794,15 +794,16 @@ pub trait App: 'static
 	/// returning `true` from [`requested_exit`](Self::requested_exit).
 	fn shell_mode( &self ) -> ShellMode { ShellMode::Window }
 
-	/// Content for the lock surfaces the runtime creates on every output
-	/// beyond the first while in [`ShellMode::SessionLock`]. The compositor
-	/// blanks any output without a lock surface, so the runtime covers each
-	/// one; this view is what gets painted there (typically the same
-	/// wallpaper as the main surface, without the interactive form).
+	/// Content for the surfaces the runtime creates on every output beyond
+	/// the first. In [`ShellMode::SessionLock`] these are lock surfaces —
+	/// the compositor blanks any output without one, so each is covered. In
+	/// [`ShellMode::Layer`] on [`Layer::Background`] they are background
+	/// layer surfaces, so a shell's wallpaper reaches extended outputs
+	/// (typically without the grid or any chrome). They take no input.
 	/// `width` / `height` are that output's surface size in physical pixels.
 	/// Default `None`: the surface is filled with
 	/// [`background_color`](Self::background_color).
-	fn lock_secondary_view( &self, _width: u32, _height: u32 ) -> Option<Element<Self::Message>>
+	fn secondary_view( &self, _width: u32, _height: u32 ) -> Option<Element<Self::Message>>
 	{
 		None
 	}