fix(ml): remove panic vectors from NonZeroUsize::new and Debug mutex lock

Replace unwrap() on NonZeroUsize::new(config.max_models) with a safe
fallback to capacity 16, and replace unwrap() on Mutex::lock() in the
Debug impl with ok().map(...).unwrap_or(0) to avoid panics under
poisoned-mutex or zero-capacity conditions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ml/src/model_loader_integration.rs

@@ -530,7 +530,7 @@ impl LocalModelCache {
 
         // Create LRU cache with max_models capacity
         let lru = lru::LruCache::new(
-            std::num::NonZeroUsize::new(config.max_models).unwrap()
+            std::num::NonZeroUsize::new(config.max_models).unwrap_or(std::num::NonZeroUsize::new(16).expect("16 > 0"))
         );
 
         Ok(Self {
@@ -637,7 +637,7 @@ impl std::fmt::Debug for LocalModelCache {
             .field("storage", &"<Arc<Box<dyn Storage>>>")
             .field("config", &self.config)
             .field("update_sender", &"<tokio::sync::broadcast::Sender>")
-            .field("lru", &format!("<LruCache with capacity {}>", self.lru.lock().unwrap().cap().get()))
+            .field("lru", &format!("<LruCache with capacity {}>", self.lru.lock().ok().map(|g| g.cap().get()).unwrap_or(0)))
             .finish()
     }
 }