feat(chat): image specialist legacy lane, Responses fixes, ACL + UI attachments

- Image expert: DashScope-style /chat/completions via image_legacy_client; early exit in
  direct_loop when skill_binding_role is image; shared placeholder helper; docs/IMAGE_SPECIALIST_LANE.md.
- Strict attachment ACL: link_attachment_acl on assistant chat_message rows (sqlite_store);
  chat attachment rate limit when user_id empty; admin chat tests updated.
- Admin chat UI: aggregate bubbles render assistant_text attachments (image_ref); WS expand path.
- turn_runner: persisted_chat_attachments_nonempty for final_msg selection.
- OpenAI Responses transport + agent_messages/agent_core_attempt adjustments; env docs and tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

interfaces/admin/chat_api.py

@@ -343,9 +343,10 @@ def _can_access_attachment(store: SqliteStore, ctx: dict[str, Any], *, attachmen
 def _rate_limit_attachment_download(*, actor_tenant_id: str, actor_user_id: str) -> bool:
     tid = str(actor_tenant_id or "").strip()
     uid = str(actor_user_id or "").strip()
-    if not tid or not uid:
+    # Require tenant; allow downloads when user id is unexpectedly empty (rate bucket is tenant-scoped).
+    if not tid:
         return False
-    key = f"{tid}:{uid}"
+    key = f"{tid}:{uid or '__actor__'}"
     now = time.time()
     with _ATT_DOWNLOAD_LOCK:
         tokens, last = _ATT_DOWNLOAD_BUCKET.get(key, (_ATT_DOWNLOAD_BURST, now))