fix(ai): validate aiwin pointer to prevent UAF when window closed

Prevent use-after-free in the AI request worker thread when the user
closes the AI window during the 60-second HTTP request timeout. Without
this fix, the worker may dereference a dangling pointer and crash or
exhibit undefined behavior.

The _ai_request_thread function in ai_client.c previously cast user_data
to ProfAiWin* and used it directly without verifying the window was still
alive. Added wins_ai_exists() to iterate through all AI windows and check
if the pointer is still valid before use.

Safety:
- wins_ai_exists() iterates all AI windows (handles multiple AI windows)
- Worker skips UI update if window was freed, just cleans up
- Logs warning when dangling pointer is detected

src/ui/window_list.c

@@ -885,6 +885,27 @@ wins_get_ai(void)
     return NULL;
 }
 
+gboolean
+wins_ai_exists(ProfAiWin* const aiwin)
+{
+    if (!aiwin) {
+        return FALSE;
+    }
+
+    GList* curr = values;
+    while (curr) {
+        ProfWin* window = curr->data;
+        if (window->type == WIN_AI) {
+            if ((ProfAiWin*)window == aiwin) {
+                return TRUE;
+            }
+        }
+        curr = g_list_next(curr);
+    }
+
+    return FALSE;
+}
+
 void
 wins_lost_connection(void)
 {

src/ui/window_list.h

@@ -64,6 +64,7 @@ ProfPluginWin* wins_get_plugin(const char* const tag);
 ProfXMLWin* wins_get_xmlconsole(void);
 ProfVcardWin* wins_get_vcard(void);
 ProfAiWin* wins_get_ai(void);
+gboolean wins_ai_exists(ProfAiWin* const aiwin);
 
 void wins_close_plugin(char* tag);