Bump to 0.2.0: SW/GLES paint parity, shared font resolution, FrameState refactor, docs and packaging fixes

Rendering parity (software ↔ GLES). The software backend now rounds glyph pen positions and image destinations to the nearest integer pixel, matching what the GLES backend already did; previously it truncated, so text and 1:1 images could land up to half a pixel off between the two backends and the bilinear sample read ~1 px softer than the source. Gradients and shadows are deliberately left unimplemented on the software backend, and the GLES multi-rect `glScissor` clip is left coarse on purpose: making it exact would need stencil bits the EGL config does not carry, or routing the partial-redraw path through the offscreen clip layer, which would break its `fill` / `clear_rects_transparent` scissor semantics. Adds software-backend pixel tests covering the snapping.
Font resolution unification. The system-font candidate chain, `find_font_opt` and `load_default_font_bytes` lived in two copies (`render/helpers` and `gles_render/helpers`) that had already diverged — one resolved through `find_font_opt`, the other inlined the candidate loop — and now live once in `system_fonts`. The two per-backend `OnceLock` default-font caches and `primary_handle` collapse into a single `system_fonts::default_handle`. Module docs and the `font_registry` caller are updated accordingly.
Shared image validation and rect inflation. `draw_image_data`'s dimension check and its one-line warning were byte-duplicated across both backends and are now `render::helpers::validate_rgba_dims`. The six manual symmetric `Rect`-inflate literals in the GLES primitives reuse the existing `Rect::expand`.
FrameState and DrawCtx de-duplication. The eleven `SurfaceState` fields the draw pass owns and threads through `DrawCtx` — `widget_rects`, the cursor / selection maps, the scroll state, `accessible_extras`, `prev_focused` / `prev_hovered` / `prev_pressed` — move into a `FrameState` sub-struct. The per-frame `build_draw_ctx` / `commit_draw_ctx` helpers can then borrow `&mut ss.frame`, disjoint from `ss.canvas` and `ss.pool`, so the four frame paths (software / GLES × full / partial) replace their duplicated `DrawCtx` construction and write-back with a single helper call each. A whole-`SurfaceState` borrow could not express this (partial borrows do not cross function boundaries), which is why the helpers take the sub-struct. `content_dirty` stays on `SurfaceState` — it is an invalidation flag, not frame state — and is reset at the call site.
rich_text tests. Adds the previously-missing `tests.rs` for the `RichText` widget: one hit rect per visual line a link spans (the widget's core invariant), the single-line and no-link cases, preferred-size growth with hard line breaks, and `map_msg` range preservation — all headless against a software `Canvas`, with line counts forced by `\n` so they do not depend on any system font's measured width.
Documentation. Fills the rustdoc gaps on the embedder-facing surface: `core::UiSurface` accessors, the `egl_context` public API, the `GlesCanvas` methods, `theme::typography` and `theme::error`, and the `RichText` / `Text` builders; adds a crate-level "Rendering backends" overview. `CHANGELOG.md` is added (0.2.0 / 0.1.0), and `docs/widgets.md` / `docs/cookbook.md` gain `rich_text`, `external`, and the CPU-draw / path-clip / externally-laid-out-tree recipes. `debian/changelog` gets the 0.2.0-1 entry. Private intra-doc links to `system_fonts` are demoted to code spans so `cargo doc` is warning-free.
Packaging. The `libltk-dev` registry crate shipped a `Cargo.toml` declaring the `lookup` bench while the `Makefile` install copied only `src/`, so Cargo refused to parse the manifest over a missing `benches/lookup.rs`; the install now ships `benches/` as well (the file alone satisfies the parse — criterion is a dev-dependency and is not resolved when the crate is consumed as a library). `Cargo.toml` is bumped to 0.2.0 to match the package version and the `ltk-0.2.0` registry directory.

src/system_fonts.rs

@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: LGPL-2.1-only
 // Copyright (C) 2026 Liberux Labs, S. L. <info@liberux.net>
 
-//! Lazy per-glyph fallback font resolution.
+//! Process-wide font resolution for both backends: the primary UI font
+//! ([`default_handle`] / [`primary_handle`], loaded once from the
+//! [`SYSTEM_FONT_CANDIDATES`] chain) and lazy per-glyph fallback.
 //!
 //! The default font ([`crate::theme::fallback::FALLBACK_FONT`], Sora)
 //! covers Latin and a portion of extended Latin; everything outside
@@ -147,20 +149,76 @@ pub fn lookup( ch: char ) -> Option<Arc<Font>>
 	lookup_handle( ch ).map( |h| h.font )
 }
 
-/// The process-wide primary UI font — the same default a canvas loads — cached
-/// for standalone text measurement (e.g. an embedded measure pass with no live
-/// canvas). Falls back to the bundled font when no system font is found.
-pub fn primary_handle() -> FontHandle
+/// System-font search chain for the primary UI font, ordered by preference.
+/// Shared by [`find_font_opt`] and [`load_default_font_bytes`].
+const SYSTEM_FONT_CANDIDATES: &[&str] =
+&[
+	// Debian `fonts-sora` — the canonical path `ltk-theme-default`
+	// depends on. Listed first so Sora wins as the default font
+	// whenever the package is installed.
+	"/usr/share/fonts/opentype/sora/Sora-Regular.otf",
+	"/usr/share/fonts/truetype/sora/Sora-Regular.ttf",
+	"/usr/share/fonts/sora/Sora-Regular.ttf",
+	"/usr/share/fonts/TTF/Sora-Regular.ttf",
+	"/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
+	"/usr/share/fonts/liberation/LiberationSans-Regular.ttf",
+	"/usr/share/fonts/truetype/freefont/FreeSans.ttf",
+	"/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
+	"/usr/share/fonts/dejavu/DejaVuSans.ttf",
+	"/usr/share/fonts/TTF/DejaVuSans.ttf",
+];
+
+/// Resolve the first system font available from [`SYSTEM_FONT_CANDIDATES`], or
+/// `None` if none exist. Used by the font registry and by tests that skip
+/// gracefully on images without the usual fonts installed.
+pub ( crate ) fn find_font_opt() -> Option<String>
+{
+	SYSTEM_FONT_CANDIDATES.iter()
+		.find( |p| std::path::Path::new( p ).exists() )
+		.copied()
+		.map( str::to_string )
+}
+
+/// Load the bytes of a default system font. Tries the candidate chain via
+/// [`find_font_opt`]; falls back to the embedded
+/// [`crate::theme::fallback::FALLBACK_FONT`] (Sora Regular, ~50 KB, OFL 1.1)
+/// when nothing matches or the file cannot be read. Always returns usable bytes
+/// so canvas construction never panics on a system without the expected fonts.
+pub ( crate ) fn load_default_font_bytes() -> Vec<u8>
+{
+	if let Some( path ) = find_font_opt()
+	{
+		if let Ok( bytes ) = std::fs::read( &path )
+		{
+			return bytes;
+		}
+	}
+	crate::theme::fallback::FALLBACK_FONT.to_vec()
+}
+
+/// The process-wide primary UI font handle — the single default every canvas
+/// loads. Cached so a layer shell bringing up several surfaces parses the small
+/// Sora face once rather than per surface. The per-glyph fallback chain (Noto
+/// Sans / CJK / Devanagari / …) is loaded lazily through [`lookup`], not here.
+pub ( crate ) fn default_handle() -> FontHandle
 {
 	static PRIMARY: OnceLock<FontHandle> = OnceLock::new();
 	PRIMARY.get_or_init( ||
 	{
-		let bytes = crate::render::helpers::load_default_font_bytes();
+		let bytes = load_default_font_bytes();
 		let font  = Font::from_bytes( bytes.as_slice(), FontSettings::default() ).expect( "primary font parses" );
 		FontHandle { font: Arc::new( font ), bytes: Arc::new( bytes ), face: 0 }
 	} ).clone()
 }
 
+/// The process-wide primary UI font — the same default a canvas loads — for
+/// standalone text measurement (e.g. an embedded measure pass with no live
+/// canvas). Falls back to the bundled font when no system font is found.
+pub fn primary_handle() -> FontHandle
+{
+	default_handle()
+}
+
 /// Bytes-aware variant of [`lookup`]. Returns the full
 /// [`FontHandle`] (fontdue handle + raw bytes + face index) so
 /// callers that need to invoke a HarfBuzz-style shaper can do so