`Plot::show()` panics when no opener binary exists, and silently no-ops when it fails

Plot::show() offers no way for a caller to handle a failed browser handoff.
Running it on a headless server causes a panic, but the panic message is misleading.

How to reproduce

use plotly::{Plot, Scatter};

fn main() {
    let mut plot = Plot::new();
    plot.add_trace(Scatter::new(vec![0, 1, 2], vec![0.0, 1.5, 3.0]));
    plot.show();
}

Run on a headless Linux host with no xdg-open on PATH 👍

thread 'main' panicked at .../plotly-0.14.1/src/plot.rs:789:14:
Could not find default application for HTML files.
[...]
: Os { code: 2, kind: NotFound, message: "No such file or directory" }

Environment

• plotly 0.14.1
• rustc 1.98.0
• AlmaLinux 9.8

Expected

A library call should not abort the process over a missing external binary. The caller should have
some way to detect this and potentially fall back to write_html() or write_image() on its own or
show a clear error message.

Cause

https://github.com/plotly/plotly.rs/blob/00fe0512e9f924bd0fc2edfc6cc617a1604f4e0d/plotly/src/plot.rs#L793-L800

There are two problems with it:

1. Missing binary panics: .output() returns Err only when the process cannot be
   spawned, i.e. xdg-open is not on PATH. .expect() turns that into a panic, and
   show() returns (), so a caller has nothing to match on.
   The resulting error message is very misleading here: https://github.com/plotly/plotly.rs/blob/00fe0512e9f924bd0fc2edfc6cc617a1604f4e0d/plotly/src/plot.rs#L57-L65

2. Return code of the xdg-open is ignored: If xdg-open is installed but exits non-zero
   (e.g. when no application is registered for HTML) it still returns Ok, carrying
   the failure inside Output::status, but status is never read.

The macOS and Windows variants have a similar shape.

Start in plotly/src/plot.rs at the referenced Plot::show() implementation and inspect the Linux, macOS, and Windows branches, including the error definitions near lines 57-65. Reproduce the headless Linux case, then verify that missing opener binaries and non-zero opener statuses are reported to callers rather than causing a panic or being silently ignored.