Plug-ins: filters keep data with the document (G17)

A filter plug-in had nowhere to keep settings that belong to the whole
document rather than to one object, such as the pens a plotter holds or
a machine profile: it could only ask for them again on every run.

- A filter's output may hold documentData: any JSON of at most 1 MiB
  (objects::MAX_DOCUMENT_DATA) that replaces what the plug-in keeps with
  the document, null removing it, in the same undo step as its objects
  (objects::decode_output). Too much refuses the output and the
  document stays as it was.
- A filter gets it back in _context.documentData (null until it keeps
  something). A filter reads and writes only its own.
- It is the document's foreign data, Document::unknown["pluginData"] by
  plug-in id (vectorcraft_doc::plugin_data), where the perspective grid
  and the brushes keep theirs. So the native file needs no section of
  its own for it, and hosts from before keep it when they save. An
  exporter is given the whole document, so it can read every
  plug-in's. Nothing else lists it, as the reference app's Document
  Info lists no plug-in data.

A live effect isn't given it: its geometry is worked out from the
object alone wherever it is drawn.

Tests: plugin_data.rs (each plug-in its own entry, forgetting what isn't
kept copies nothing, a damaged value holds nothing), objects/tests.rs
(kept, forgotten, refused over the limit), tests_plugins.rs (one undo
step with the objects, read back, not given to another filter, kept by
the native file among its foreign data, refused over the limit with the
document unchanged, null removes it) and tests/plugin_export.rs (an
exporter finds another plug-in's). The size error has its row in each complete
catalog (COMPLETE_MESSAGES).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhvnnnD5fTFupK8WWq35un

crates/plugins/src/objects/tests.rs

@@ -269,3 +269,25 @@ fn bad_stroke_styles_and_effect_records_are_refused() {
         assert!(decode_json(json!({"objects": [{"id": a, "effects": bad}]})).is_err(), "{bad}");
     }
 }
+
+/// A filter's `documentData`: absent keeps what the plug-in keeps, `null` forgets it, any other JSON
+/// of at most [`MAX_DOCUMENT_DATA`] bytes is kept, and more refuses the whole output.
+#[test]
+fn document_data_is_kept_forgotten_or_refused() {
+    let out = |data: Option<Value>| {
+        let mut v = json!({"objects": []});
+        if let Some(data) = data {
+            v["documentData"] = data;
+        }
+        decode_output(v.to_string().as_bytes()).map(|o| o.document_data)
+    };
+    assert_eq!(out(None).unwrap(), None);
+    assert_eq!(out(Some(Value::Null)).unwrap(), Some(None));
+    assert_eq!(out(Some(json!({"pens": 2}))).unwrap(), Some(Some(json!({"pens": 2}))));
+    // A string's quotes count: this one is the limit exactly, and one more byte refuses it.
+    let at = json!("x".repeat(MAX_DOCUMENT_DATA - 2));
+    assert_eq!(out(Some(at.clone())).unwrap(), Some(Some(at)));
+    assert!(matches!(out(Some(json!("x".repeat(MAX_DOCUMENT_DATA - 1)))), Err(Error::Output(_))));
+    // A decline is still a decline.
+    assert!(matches!(decode_output(br#"{"error": "No pens.", "documentData": 1}"#), Err(Error::Failed(_))));
+}