fix(chat): snapshot reused response images and stop caching live image URLs

[bdunn77]

Fixes #1865

Problem

Chat bubbles that embed generated images via live workdir paths (img:///a0/usr/workdir/logo.png or /api/image_get?path=...) do not keep a historical copy. Reusing the same filename overwrites the file, so older bubbles show the newest image. Reloading the WebUI makes this ubiquitous because replay re-fetches every URL from disk.

A second overlapping bug: /api/image_get served a generic fallback icon with Cache-Control: public, max-age=3600 when the file was missing. The browser could cache that icon under the PNG URL, so some bubbles failed to load even before a reload.

Browser screenshots and vision-load artifacts already use unique chat-scoped names. Response-embedded workdir images did not.

Fix

• Snapshot finished response img:// / /api/image_get?path= local image refs onto unique files under usr/chats/<id>/images/response/.
• Leave already chat-scoped artifacts and missing files unchanged.
• Store parallel-worker snapshots on the parent chat id.
• Stop caching missing-file fallback icons (no-store). Revalidate mutable workdir files (no-cache). Keep max-age=3600 only for unique chat artifacts.

This is forward-looking. Already overwritten files cannot be restored from chat.json.

Tests

/opt/venv-a0/bin/python -m pytest tests/test_image_get_security.py tests/test_chat_media_response_snapshots.py -q --tb=short

13 passed.

Notes

• Searched open/closed issues and PRs; no existing community fix for this.
• Target is main, matching current comparable upstream PRs.