fix(plugins): degrade ensure_plugin_state instead of panicking

Bug:
The typed ensure_plugin_state helper and the object-safe trait method
it wraps turned two recoverable conditions into process deaths. On the
in-process host, the helper downcast the stored state with
.expect("plugin state type mismatch for plugin_id"), so registering
state under one plugin_id as one type and later asking for another
(e.g. a reloaded plugin version changes the type while the per-tab
state map survives) panicked the host. On out-of-process hosts
(ipc/client.rs, ipc/v4/client.rs) and on NullHost, the trait method
itself was implemented as a bare panic!("ensure_plugin_state is not
supported for out-of-process plugins..."), so any out-of-process
plugin calling the documented helper crashed its own runner process -
even though the sibling plugin_state_any and plugin_state_any_mut
methods on those same implementations already degrade to None
gracefully. The helper also used .expect("init called once") on the
initialiser closure.

Reproduce:
1. Out-of-process: a plugin whose runner calls ensure_plugin_state
   (&mut host, "my.id", ...).
2. Type mismatch: in an in-process plugin, ensure state under one id
   as u32, then ensure a different type under the same id.
3. Before: step 1 kills the plugin runner at the trait panic; step 2
   kills the host at the downcast expect. After: both get None, keep
   running, and existing state is untouched.

Fix:
Give the trait method a failure channel: ensure_plugin_state_any now
returns Option<&mut (dyn Any + Send + Sync)>, mirroring the sibling
plugin_state_any_mut on the same implementations, and the typed helper
returns Option<&mut T> (any?.downcast_mut). The panicking
implementations (ipc v3, ipc v4, NullHost, and the three never-called
test dummies) return None; the in-process app host wraps its real
storage in Some with unchanged insert-or-return semantics. The init
closure is now guarded by take() with a unit-Any fallback, so even an
implementation invoking it twice fails the typed downcast instead of
panicking. Object safety, argument types and vtable slot are
unchanged; external plugin sources get a compile error at the helper
and adopt Option handling on rebuild. Regression tests use catch_unwind
so they compile against both signatures: one per panic site (out-of-
process, NullHost, type mismatch), each additionally asserting the
None result and that pre-existing state survived.

crates/ocs_plugin_api/src/ipc/client.rs

@@ -364,10 +364,11 @@ impl HostApi for PluginHostApi {
         &mut self,
         _plugin_id: &'static str,
         _init: &mut dyn FnMut() -> Box<dyn Any + Send + Sync>,
-    ) -> &mut (dyn Any + Send + Sync) {
+    ) -> Option<&mut (dyn Any + Send + Sync)> {
         // Same limitation as `plugin_state_any`. This would need a serializable
-        // state contract to work across processes.
-        panic!("ensure_plugin_state is not supported for out-of-process plugins; keep state in the plugin crate")
+        // state contract to work across processes. Degrade to `None` so plugins
+        // keep running with state unavailable instead of crashing the runner.
+        None
     }
 
     fn document_reader(&self) -> Box<dyn DocumentReader + '_> {
@@ -633,6 +634,22 @@ mod tests {
         (api, client_stream)
     }
 
+    #[test]
+    fn ensure_plugin_state_does_not_panic_for_out_of_process_hosts() {
+        let (mut api, _peer) = make_client();
+        let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let _ = api.ensure_plugin_state_any("opencad.demo", &mut || Box::new(7u32));
+        }));
+        assert!(
+            outcome.is_ok(),
+            "out-of-process ensure_plugin_state must degrade, not panic: {:?}",
+            outcome.err()
+        );
+        assert!(api
+            .ensure_plugin_state_any("opencad.demo", &mut || Box::new(7u32))
+            .is_none());
+    }
+
     #[test]
     fn push_info_emits_request() {
         let (mut api, mut peer) = make_client();

crates/ocs_plugin_api/src/ipc/v4/client.rs

@@ -607,8 +607,10 @@ impl HostApi for V4PluginHostApi {
         &mut self,
         _plugin_id: &'static str,
         _init: &mut dyn FnMut() -> Box<dyn Any + Send + Sync>,
-    ) -> &mut (dyn Any + Send + Sync) {
-        panic!("ensure_plugin_state is not supported for out-of-process plugins; keep state in the plugin crate")
+    ) -> Option<&mut (dyn Any + Send + Sync)> {
+        // Same limitation as `plugin_state_any`; degrade to `None` so the
+        // plugin keeps running instead of dying on its own helper call.
+        None
     }
 
     fn document_reader(&self) -> Box<dyn DocumentReader + '_> {