Read the MIME icon cache buster from initial state before Theming global assignment

Repository: https://github.com/nextcloud/server

core/src/OC/mimeType.js reads window.OCA.Theming.cacheBuster in getIconUrl. This throws when valid theming/data initial state is present but the additional OCA.Theming assignment has not happened or the OCA namespace has been replaced. Recommendations calls this method when initializing RecommendedFile.

The affected source is byte-identical in Nextcloud v33.0.6, v33.0.8 and stable33 revision cf340916779182c899e2e9d5bfebcaff5dfc6058.

Reproduction: provide valid initial state theming/data with {cacheBuster: 73}, normal OC MIME/theme configuration and window.OCA = {}; call getIconUrl('text/plain'). The global property lookup throws even though the needed state exists. The same occurs after replacing OCA or removing it. These reproduce the unsafe dependency; the exact scheduling of the original browser incident was not recorded.

Proposed change:

+import { loadState } from '@nextcloud/initial-state'
 ...
-path += '?v=' + window.OCA.Theming.cacheBuster
+path += '?v=' + loadState('theming', 'data').cacheBuster

This uses the state object already read by apps/theming/src/theming.ts, including its shared cache identity. There is no default cache-buster and missing or malformed initial state remains an error.

Validation: 13 extracted-source cases, with three failures before and all 13 passing after. Coverage includes MIME aliases, older theme paths, unknown MIME types, cache-buster zero, cached URLs, cache clearing, later updates through the shared state object and malformed/missing state. The matching diagnostic bundle passed the same cases. A local Chromium comparison with this and two independent app corrections passed all navigation checks; a full rebuilt release remains untested.

This is a JavaScript initialization issue, distinct from the server-side AppConfig cache-buster integer/string mismatch reports for Nextcloud 34.

Start in core/src/OC/mimeType.js at getIconUrl and inspect how the theming cache buster is read. Reproduce with valid theming/data initial state and window.OCA = {}, then validate the 13 described cases, including aliases, cached URLs, cache clearing, updates, and malformed or missing state; done means all cases pass without relying on the OCA namespace.