theme, event_loop: window_controls.bar_bg slot + graceful exit on compositor disconnect

`WindowControlsSpec` gains `bar_bg`, the background fill of the SSD title-bar strip the close / maximize / minimize controls sit on. Forge used to paint that strip with `palette.surface` clamped to alpha 1.0 — a hack on a translucent panel token. With a dedicated slot the theme decides directly: `@off-white` in light and a new `@window-bar-dark` shade in dark. Schema gets the matching `Option<String>` field (defaulting to `palette.surface` to keep existing themes rendering the same) and the fallback `WindowControlsSpec` seeds `Color::WHITE` so a missing theme still draws something readable.
`try_run`'s dispatch loop previously `.expect("dispatch")`-ed every calloop error. When the compositor closes the wayland socket — `wl_display.error`, forge crashing, the user logging out — the loop saw a `BrokenPipe` / `ConnectionReset` and panicked, which polluted the user's stderr with a backtrace for what is just "the session ended". The match now treats those two `IoError` kinds as a clean shutdown: it prints `Connection::protocol_error()` (the typed `wl_display.error` if the server sent one), sets `exit_requested = true`, and lets the loop drain out normally. Any other dispatch error keeps panicking — those are still genuine bugs.

src/event_loop/mod.rs

@@ -48,9 +48,11 @@ use std::collections::HashSet;
 /// Every variant maps to a fatal failure during init: the Wayland
 /// connection, the calloop event loop, or one of the protocol bindings
 /// the runtime cannot operate without (`wl_compositor`, `wl_shm`,
-/// `xdg_wm_base`). Once init succeeds, runtime errors during the dispatch
-/// loop still panic — they are non-recoverable from the caller's point
-/// of view since the surface is already on screen.
+/// `xdg_wm_base`). Once init succeeds, the compositor disconnecting
+/// (`BrokenPipe` / `ConnectionReset`) is treated as a clean exit; any
+/// other runtime error during the dispatch loop still panics, since the
+/// surface is already on screen and the state machine cannot be unwound
+/// from this entry point.
 ///
 /// Embedders that want a software-rendered fallback or that need to
 /// degrade gracefully should call [`crate::try_run`] and match on the
@@ -373,7 +375,31 @@ pub( crate ) fn try_run<A: App>( app: A ) -> Result<(), RunError>
 		// cap the wait at its deadline so a perfectly still press still
 		// fires on time.
 		let timeout = data.next_long_press_wakeup();
-		event_loop.dispatch( timeout, &mut data ).expect( "dispatch" );
+		match event_loop.dispatch( timeout, &mut data )
+		{
+			Ok( () ) => {},
+			Err( calloop::Error::IoError( ref e ) )
+				if matches!( e.kind(), std::io::ErrorKind::BrokenPipe | std::io::ErrorKind::ConnectionReset ) =>
+			{
+				// On a fatal `wl_display.error` the compositor closes the
+				// socket; the backend has the typed error stashed but the
+				// dispatch result only carries the resulting `BrokenPipe`.
+				if let Some( pe ) = conn.protocol_error()
+				{
+					eprintln!(
+						"ltk: wayland protocol error — interface={} object_id={} code={}: {}",
+						pe.object_interface, pe.object_id, pe.code, pe.message
+					);
+				}
+				else
+				{
+					eprintln!( "ltk: wayland connection lost ({e}); exiting" );
+				}
+				data.exit_requested = true;
+				continue;
+			}
+			Err( e ) => panic!( "dispatch: {e:?}" ),
+		}
 		// Any surface whose press has now crossed `long_press_duration`
 		// emits its stored message and flips into drag mode for the rest
 		// of the gesture.