fix: defer setmon() after scene_surface creation to prevent segfault on window map

Root cause: applyrules() called setmon() which called resize(), but
resize() dereferences c->scene_surface->node before c->scene_surface
was created in mapnotify(). Fix by storing target monitor/tags in
pending_mon/pending_tags fields and calling setmon() after scene
nodes exist.

The crash affected all new windows, not just Firefox (which was
the first tested).

include/client.h

@@ -67,6 +67,10 @@ typedef struct Client {
 	bool can_fullscreen;
 	ClientRuleEffects rule_effects;
 
+	/* Deferred monitor/tags — set by applyrules, used by setmon in mapnotify */
+	Monitor *pending_mon;
+	uint32_t pending_tags;
+
 	/* COLD — wl_listeners (set up once, rarely touched after) */
 	struct wl_listener commit;
 	struct wl_listener map;