Check the canvas size before narrowing it to an int

A canvas side was cast to int with no range check, so a number that did
not fit came back as one that did: `-s 4294968296x600` rendered a
perfectly plausible 1000x600, and a hand-edited project file could ask
for a width the reader turned into something else (or, for a double out
of range, into undefined behaviour).

Both front-ends now check the side before the cast, against one shared
bound in chain.hpp — the 1..20000 the GUI spin buttons already offered,
so the help text, the CLI error, the project reader and the interface
all move together.

The tests gain a `canvas size` section covering the round trip at both
ends of the range and the refusals on either side of it, through the
project reader and through `-s`; the test binary picks up the CLI parser
to do it, which stays GUI-free.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/gui/window.cpp

@@ -176,10 +176,10 @@ Gtk::Widget& EffectorWindow::buildSidebar() {
     auto* grid = Gtk::make_managed<Gtk::Grid>();
     grid->set_column_spacing(8);
     grid->set_row_spacing(6);
-    widthSpin_.set_range(1, 20000);
+    widthSpin_.set_range(kMinCanvasSide, kMaxCanvasSide);
     widthSpin_.set_increments(1, 100);
     widthSpin_.set_value(1920);
-    heightSpin_.set_range(1, 20000);
+    heightSpin_.set_range(kMinCanvasSide, kMaxCanvasSide);
     heightSpin_.set_increments(1, 100);
     heightSpin_.set_value(1080);
     for (auto* spin : {&widthSpin_, &heightSpin_}) {