What must a plaintiff prove to make out negligence-based legal malpractice?