theme, event_loop: window_controls.bar_bg slot + graceful exit on compositor disconnect

`WindowControlsSpec` gains `bar_bg`, the background fill of the SSD title-bar strip the close / maximize / minimize controls sit on. Forge used to paint that strip with `palette.surface` clamped to alpha 1.0 — a hack on a translucent panel token. With a dedicated slot the theme decides directly: `@off-white` in light and a new `@window-bar-dark` shade in dark. Schema gets the matching `Option<String>` field (defaulting to `palette.surface` to keep existing themes rendering the same) and the fallback `WindowControlsSpec` seeds `Color::WHITE` so a missing theme still draws something readable.
`try_run`'s dispatch loop previously `.expect("dispatch")`-ed every calloop error. When the compositor closes the wayland socket — `wl_display.error`, forge crashing, the user logging out — the loop saw a `BrokenPipe` / `ConnectionReset` and panicked, which polluted the user's stderr with a backtrace for what is just "the session ended". The match now treats those two `IoError` kinds as a clean shutdown: it prints `Connection::protocol_error()` (the typed `wl_display.error` if the server sent one), sets `exit_requested = true`, and lets the loop drain out normally. Any other dispatch error keeps panicking — those are still genuine bugs.

src/theme/mod.rs

@@ -162,6 +162,8 @@ pub struct LauncherSpec
 #[ derive( Debug, Clone, Copy ) ]
 pub struct WindowControlsSpec
 {
+	/// Background fill of the SSD title bar strip the controls sit on.
+	pub bar_bg:         Color,
 	/// Symbol colour for minimize / maximize / restore / close glyphs.
 	pub icon:           Color,
 	/// Button background while hovered.
@@ -972,6 +974,7 @@ pub ( super ) fn default_window_controls( palette: Palette ) -> WindowControlsSp
 {
 	WindowControlsSpec
 	{
+		bar_bg:         Color { a: 1.0, ..palette.surface },
 		icon:           palette.icon,
 		hover_bg:       palette.surface_alt,
 		pressed_bg:     palette.divider,