Add hard viewport bounds that clamp pan and zoom

[FarhanAliRaza]

Motivation

• Provide a way to keep interactive navigation (pan/zoom) inside meaningful data extents separate from the initial domain so users cannot pan/zoom the camera completely away from the chart.
• Keep exploratory interaction available while preventing empty/partially-visible charts and preserve existing semantics for reversed and log axes.

Description

• Add a bounds field to Axis and expose bounds=(lo, hi) or bounds="data" on xy.x_axis() and xy.y_axis() so navigation limits are declaratively configurable.
• Validate bounds (including log-axis positivity) on the Python side and serialize spec["bounds"] separately from domain, resolving "data" to the data range at payload build time.
• Clamp the initial viewport, drag panning, wheel/box/button zooms, animated view transitions, and linked-view updates on the client by adding _clampAxisRange and _clampView helpers and integrating them where views are set/updated; clamping works in scale coordinates to preserve reversed and log semantics.
• Add tests/test_viewport_bounds.py covering payload serialization, "data" resolution, validation, and presence of client clamping hooks; regenerate the committed browser bundles so the shipped static client contains the clamp logic.

Testing

• Ran unit tests: PYTHONPATH=python python -m pytest tests/test_viewport_bounds.py tests/test_type_surface.py tests/test_figure.py -q and PYTHONPATH=python python -m pytest tests/test_viewport_bounds.py -q, both succeeded (final run: 166 passed, 1 skipped; viewport-bounds tests passed).
• Ran formatting and lint checks: ruff format --check / ruff check on the modified files and fixed import ordering; all checks passed.
• Rebuilt the static client: node js/build.mjs --check and verified the generated bundles; check passed.
• Ran git diff --check to ensure no whitespace/check issues; no problems found.

---

Closes #82

[codspeed-hq]

Merging this PR will not alter performance

✅ 94 untouched benchmarks
⏩ 1 skipped benchmark¹

---

_{Comparing codex/add-hard-viewport-bounds-for-pan-and-zoom (1580601) with main (ad979e8)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩

[Alek99]

Review findings:

• [P1] js/src/50_chartview.js:216: the initial viewport is clamped only in the browser, after density/decimation payloads and static-export ranges have been built. For domain=(0, 1_000_000), bounds=(0, 1), a 0..1 scatter is still binned/exported over 0..1_000_000. Clamp before payload generation, or reject incompatible domain/bounds.
• [P2] python/xy/_figure.py:1003: bounds changes renderer semantics but ships under protocol 3, so older clients silently ignore it and allow unrestricted navigation. Bump the protocol and regenerate bundles.