refactor: consolidate controller into two RefCells

Replace 8 separate Rc<RefCell<T>> fields with two:
- Rc<RefCell<ViewportState>> for zoom, pan, links, config
- Rc<RefCell<GeometryCache>> kept separate for public cache() API

This eliminates multi-borrow risk, simplifies callback closures from
capturing 5 Rcs to 2, and centralizes zoom safety via safe_zoom().

Also addresses multiple review findings:
- Links stored in HashMap<i32,(i32,i32)> (idempotent registration)
- Hit-testing facades pass iterators directly (no Vec allocation)
- Consistent safe_zoom() guard in all facades
- Deprecated set_zoom() in favor of set_viewport()
- Documented pin coordinate model (world-space, zoom-divided by Slint)
- Doc example updated to use set_viewport()

Includes 24 new unit tests covering controller facades at zoom!=1,
link registration idempotency, screen→world conversion, and zoom
safety guards.

Author: tilladam