[crisxuan]

Dragging or releasing the pet on a Retina display can move it outside every monitor. onMoved reports physical coordinates, but manual dragging and inertia write logical coordinates into the same position reference and send physical move-event coordinates back as LogicalPosition. Saved positions are also restored without checking whether the monitor still exists or whether the whole pet fits inside its work area.

This change keeps cursor samples, window movement, inertia, and saved positions in physical pixels. DOM grab offsets and logical speed limits are converted using the window scale factor. Physical coordinates are rounded before crossing the native PhysicalPosition<i32> boundary. Dragging and inertia both clamp the whole pet to the native monitor work area; startup and tray/shortcut opening recover positions inside the nearest available work area and persist the corrected coordinates.

Reproduction on v0.2.0

1. On a Mac with a 2× Retina display, drag and release the pet repeatedly. Move events can feed physical coordinates into the logical-position motion path, pushing the pet off-screen.
2. Restart the application. It restores the saved off-screen position, leaving the process and tray icon running without a visible pet.

A deterministic recovery reproduction is to quit the application, set only petX and petY in its config to an out-of-bounds physical point, and restart. The observed values were (7278, 3250) on a 3600 × 2338 physical display (1800 × 1169 logical). The fixed application restores this to (3280, 2018) inside that display's actual work area, including the full 320-pixel physical pet size.

Validation

• make all: formatting, Clippy, ESLint, TypeScript, Cargo checks, 110 frontend tests and 27 Rust tests pass.
• npm run tauri build -- --no-bundle: macOS ARM64 release build passes.
• Regression coverage: physical Retina motion with interleaved move events, fractional native coordinates, short drags released before IPC completes, slow drags without inertia, physical monitor selection, negative monitor origins, mixed scale factors, disconnected-monitor recovery, and oversized work-area clamping.
• macOS Retina smoke check: restoring the observed off-screen coordinates, screen-edge drag attempts, position persistence, and restart all keep the pet window fully inside the work area. Native window bounds after recovery are (1640, 1009, 160, 160) in logical screen coordinates.
• Physical Windows hardware and a physical secondary monitor were not available for manual verification; monitor layouts and scaling are covered by automated tests.

[liukewia]

Fixes #3