feat(chat): image specialist legacy lane, Responses fixes, ACL + UI attachments

- Image expert: DashScope-style /chat/completions via image_legacy_client; early exit in
  direct_loop when skill_binding_role is image; shared placeholder helper; docs/IMAGE_SPECIALIST_LANE.md.
- Strict attachment ACL: link_attachment_acl on assistant chat_message rows (sqlite_store);
  chat attachment rate limit when user_id empty; admin chat tests updated.
- Admin chat UI: aggregate bubbles render assistant_text attachments (image_ref); WS expand path.
- turn_runner: persisted_chat_attachments_nonempty for final_msg selection.
- OpenAI Responses transport + agent_messages/agent_core_attempt adjustments; env docs and tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

_local/system.env.example

@@ -276,18 +276,25 @@ AIA_REPLAY_REASONING_SIGNATURE_POLICY=
 OPENAI_IMAGE_MODEL=
 OPENAI_AUDIO_TRANSCRIPTION_MODEL=
 
-# query_image_attachment / send_ocr_image_messages（三项必填，无缺省模型 id）
+# query_image_attachment、OCR 降级 send_ocr_image_messages — 仅用 AIA_OCR_*（与图片专家互不继承）
 AIA_OCR_MODEL=
 AIA_OCR_BASE_URL=
 AIA_OCR_API_KEY=
 AIA_OCR_CHAT_ENDPOINT=
 
+# specialist=image → send_legacy_image_messages — 仅用 AIA_IMAGE_EXPERT_*（禁止与 AIA_OCR_* 混用通道）
+AIA_IMAGE_EXPERT_MODEL=
+AIA_IMAGE_EXPERT_BASE_URL=
+AIA_IMAGE_EXPERT_API_KEY=
+AIA_IMAGE_EXPERT_CHAT_ENDPOINT=
+
+# Optional; image expert top-level kwargs (parity with DashScope multimodal-gen samples)
+DASHSCOPE_IMAGE_STREAM=
 DASHSCOPE_IMAGE_N=
 DASHSCOPE_IMAGE_WATERMARK=
 DASHSCOPE_IMAGE_NEGATIVE_PROMPT=
 DASHSCOPE_IMAGE_PROMPT_EXTEND=
 DASHSCOPE_IMAGE_SIZE=
-DASHSCOPE_IMAGE_MODEL=
 
 CLOUDFLARE_ACCOUNT_ID=
 CLOUDFLARE_API_TOKEN=