fix(plugin): clear brokered session state on logout

sessionStorage outlives a logout inside the same tab, so the keys stay readable
after the next user signs in. They are namespaced by user id, which stops the new
user's plugins from reading them, but the data is still sitting in the tab — the
same reason logout already drops the appearance snapshot, the SW caches and the
user-scoped offline DB. Purge them there too.

Three things around it, from reading the handlers next to the new ones:

- The inactive-plugin purge ran before the store was updated, so a sessionStorage
  failure cost us the plugin list we had just fetched. Commit first, purge after.
- The session handlers answered without checking requestId, unlike confirm and
  geolocation — an answer the frame can never match is worth skipping.
- The mock host threw plain Errors while the real bridge rejects with .code set,
  and checked the key before the trip scope where the host does the reverse, so a
  plugin's error handling could pass its tests and still break in the app.

client/src/store/pluginStore.test.ts

@@ -1,7 +1,7 @@
-// FE-STORE-PLUGIN-001 to 004
+// FE-STORE-PLUGIN-001 to 006
 import { http, HttpResponse } from 'msw';
 import { server } from '../../tests/helpers/msw/server';
-import { usePluginStore } from './pluginStore';
+import { usePluginStore, clearAllPluginSessions } from './pluginStore';
 
 const initial = usePluginStore.getState();
 
@@ -72,4 +72,31 @@ describe('pluginStore', () => {
     expect(sessionStorage.getItem('trek:plugin-session:7:disabled:trip:42:view')).toBeNull();
     expect(sessionStorage.getItem('trek_session')).toBe('app-session');
   });
+
+  it('FE-STORE-PLUGIN-005: clearAllPluginSessions drops every user and scope, but nothing else', () => {
+    sessionStorage.setItem('trek:plugin-session:7:active:plugin:filters', '["flight"]');
+    sessionStorage.setItem('trek:plugin-session:9:active:trip:42:view', '"table"');
+    sessionStorage.setItem('trek_session', 'app-session');
+
+    clearAllPluginSessions();
+
+    expect(sessionStorage.getItem('trek:plugin-session:7:active:plugin:filters')).toBeNull();
+    expect(sessionStorage.getItem('trek:plugin-session:9:active:trip:42:view')).toBeNull();
+    expect(sessionStorage.getItem('trek_session')).toBe('app-session');
+  });
+
+  it('FE-STORE-PLUGIN-006: a sessionStorage failure during the purge still keeps the loaded plugins', async () => {
+    const key = vi.spyOn(Storage.prototype, 'key').mockImplementation(() => { throw new Error('storage disabled'); });
+    server.use(
+      http.get('/api/plugins', () =>
+        HttpResponse.json({ plugins: [{ id: 'active', name: 'Active', type: 'widget', icon: null }] }),
+      ),
+    );
+
+    await usePluginStore.getState().loadPlugins();
+
+    expect(usePluginStore.getState().plugins.map((p) => p.id)).toEqual(['active']);
+    expect(usePluginStore.getState().loaded).toBe(true);
+    key.mockRestore();
+  });
 });