Check the canvas size before narrowing it to an int

A canvas side was cast to int with no range check, so a number that did
not fit came back as one that did: `-s 4294968296x600` rendered a
perfectly plausible 1000x600, and a hand-edited project file could ask
for a width the reader turned into something else (or, for a double out
of range, into undefined behaviour).

Both front-ends now check the side before the cast, against one shared
bound in chain.hpp — the 1..20000 the GUI spin buttons already offered,
so the help text, the CLI error, the project reader and the interface
all move together.

The tests gain a `canvas size` section covering the round trip at both
ends of the range and the refusals on either side of it, through the
project reader and through `-s`; the test binary picks up the CLI parser
to do it, which stays GUI-free.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/CMakeLists.txt

@@ -1,4 +1,6 @@
-add_executable(effector_tests core_tests.cpp)
+# The CLI parser joins the core here: it is GUI-free too, and the canvas size
+# it produces has to obey the same bounds a project file does.
+add_executable(effector_tests core_tests.cpp ../src/cli/options.cpp)
 target_link_libraries(effector_tests PRIVATE effector_core)
 target_compile_options(effector_tests PRIVATE -Wall -Wextra -Wpedantic)