fix(window): check the saved position against the monitors, not their bounding box

Reported from a multi-monitor station: window.json held x=-7680 and the
window opened where nobody could see it, with no way back short of
editing the file — which nobody knows to do.

The guard existed but asked the wrong question. It tested the position
against the VIRTUAL SCREEN, the rectangle spanning every monitor, and
monitors rarely tile that rectangle: a wide screen beside a tall one, or
one mounted higher, leaves gaps inside the box that belong to no monitor.
A window in a gap passes a bounding-box test and is invisible. The test
now walks the monitors themselves, through EnumDisplayMonitors, and uses
each one's WORK area — a title bar under the taskbar cannot be dragged
either.

A position that is genuinely lost is now MOVED onto the nearest monitor,
keeping the window's size. Handing it back to Windows lost the size too
and dropped the window on the primary screen wherever Windows chose.

The arithmetic is in screenclamp.go with no Win32 in it, and tested
against the reporter's four-monitor layout and against a gap between two:
this fault is invisible by definition and cannot be reproduced without
the reporter's screens, so a table test is the only place it can be held.
The layout is also logged at every start, since the first question after
'OpsLog does not open' is what the screens looked like.

app.go

@@ -2101,6 +2101,7 @@ func (a *App) restoreWindowPosition() {
 	if a.ctx == nil {
 		return
 	}
+	logMonitorLayout()
 	ws, ok := readWindowState(a.dataDir)
 	if !ok {
 		applog.Printf("window: no saved geometry — opening where Windows puts it")
@@ -2139,8 +2140,19 @@ func (a *App) restoreWindowPosition() {
 	// forever — with no way back short of deleting window.json, which nobody
 	// knows to do. Fall back to the default placement instead.
 	if !onSomeMonitor(ws.X, ws.Y, ws.Width, ws.Height) {
-		applog.Printf("window: saved position %d,%d (%dx%d) is off every monitor — opening at the default placement",
-			ws.X, ws.Y, ws.Width, ws.Height)
+		// Moved onto the nearest monitor rather than handed back to Windows.
+		// Giving up lost the size as well as the position and dropped the window
+		// on the primary screen wherever Windows felt like; clamping keeps the
+		// window the operator had, somewhere they can see it.
+		nx, ny, moved := clampToVisible(ws.X, ws.Y, ws.Width, ws.Height)
+		if !moved {
+			applog.Printf("window: saved position %d,%d (%dx%d) is off every monitor and no monitor could be read — opening at the default placement",
+				ws.X, ws.Y, ws.Width, ws.Height)
+			return
+		}
+		applog.Printf("window: saved position %d,%d is off every monitor (%s) — moved to %d,%d",
+			ws.X, ws.Y, describeMonitors(monitorRects()), nx, ny)
+		wruntime.WindowSetPosition(a.ctx, nx, ny)
 		return
 	}
 	wruntime.WindowSetPosition(a.ctx, ws.X, ws.Y)
@@ -2151,13 +2163,7 @@ func (a *App) restoreWindowPosition() {
 // pixel: a window overlapping the screen edge by 2 px is, in practice, as lost
 // as one entirely outside it. When the desktop bounds can't be read, it says yes
 // — better to honour the operator's saved position than to second-guess it.
-func onSomeMonitor(x, y, w, h int) bool {
-	vx, vy, vw, vh, ok := virtualScreenBounds()
-	if !ok {
-		return true
-	}
-	return overlapsEnough(x, y, w, h, vx, vy, vw, vh)
-}
+func onSomeMonitor(x, y, w, h int) bool { return onSomeMonitorImpl(x, y, w, h) }
 
 // overlapsEnough is the geometry behind onSomeMonitor, split out so it can be
 // tested — the virtual desktop origin is NEGATIVE when a monitor sits left of or