Replay catalog omits the image capacity required by saved histories

## Problem

The replay proxy's `GET /models` response advertises vision support but does not declare `capabilities.limits.vision.max_prompt_images`. Saved image conversations can require two image-bearing messages: an attached blob and a subsequent image-view result.

When a runtime applies a one-image fallback for the omitted capability, these histories no longer match the strict replay snapshots. The proxy reports a missing cached response rather than completing the attachment or model-vision scenario.

Affected scenarios include both `SessionConfigE2ETests.Should_Accept_Blob_Attachments` and `SessionE2ETests.Should_Accept_Blob_Attachments`, plus `SessionConfigE2ETests.Vision_Disabled_Then_Enabled_Via_SetModel`.

## Expected behavior

The fake catalog should explicitly support the image capacity required by its recorded conversations. Keep the original attachment and vision assertions, saved histories, and strict replay matching intact.

An explicit two-image capacity resolves these scenarios. A harness-only fix and HTTP endpoint regression coverage are prepared; no product change or retry is needed.

_Generated by Copilot_

Start at the replay proxy's GET /models response and inspect how its fake catalog declares vision limits. Run the named SessionConfigE2ETests and SessionE2ETests attachment and vision scenarios, then confirm the catalog advertises capacity for two images while the saved histories, strict replay matching, and original assertions remain intact.

Written by the indexing model from the issue text.