Harden paste process plugin pipeline and cap max non-file paste size input

[guiyanakuang]

Closes #4700

Summary

Follow-up hardening after #4698 / #4699, in three parts:

1. Isolate plugin failures in PasteReleaseService.releaseLocalPasteData. Each PasteProcessPlugin.process call is now wrapped in runCatching: on failure the plugin's transformation is skipped with a warning log and the pipeline continues with the current items. Previously a throwing plugin (e.g. FilesToImagesPlugin on a failed file move) aborted the whole loop and left the paste row stuck in LOADING state forever. This is graceful degradation, not rollback — a plugin that failed mid-mutation may still leave its own item imperfect, but the row always reaches a terminal state.

2. Document the plugin order invariants at the pasteProcessPlugins assembly site in DesktopPasteComponentModule. The order is load-bearing and the constraints were previously only implicit — notably DiscardOversizedNonFilePlugin must precede DistinctPlugin (otherwise FirstPlugin may keep an oversized first item and clear a smaller surviving variant from disk before the oversized one is discarded), plugins placed after the size check must never emit items larger than their already-checked sources, and SortPlugin must stay last because the first item determines the row's type/hash/search content. Mobile assembles the same commonMain plugins and must keep these invariants.

3. Cap the maxNonFilePasteSize settings input to 1..64 MB. Without an upper bound the setting could effectively disable the oversized-item guard. The Counter rule rejects out-of-range values from both the +/- buttons and typed input; the bound is UI-level validation only, consistent with sibling settings.

Test plan

• ./gradlew app:compileKotlinDesktop app:compileTestKotlinDesktop clean
• ./gradlew app:desktopTest --tests "*DiscardOversized*" --tests "*PasteReleaseService*" — 11 tests pass
• ktlintFormat applied