Replay catalog omits the image capacity required by saved histories

## Problem

The replay proxy's `GET /models` response advertises vision support but does not declare `capabilities.limits.vision.max_prompt_images`. Saved image conversations can require two image-bearing messages: an attached blob and a subsequent image-view result.

When a runtime applies a one-image fallback for the omitted capability, these histories no longer match the strict replay snapshots. The proxy reports a missing cached response rather than completing the attachment or model-vision scenario.

Affected scenarios include both `SessionConfigE2ETests.Should_Accept_Blob_Attachments` and `SessionE2ETests.Should_Accept_Blob_Attachments`, plus `SessionConfigE2ETests.Vision_Disabled_Then_Enabled_Via_SetModel`.

## Expected behavior

The fake catalog should explicitly support the image capacity required by its recorded conversations. Keep the original attachment and vision assertions, saved histories, and strict replay matching intact.

An explicit two-image capacity resolves these scenarios. A harness-only fix and HTTP endpoint regression coverage are prepared; no product change or retry is needed.

_Generated by Copilot_

从 replay proxy 的 GET /models 响应开始，检查其 fake catalog 如何声明 vision 限制。运行指定的 SessionConfigE2ETests 和 SessionE2ETests attachment 与 vision 场景，然后确认 catalog 宣布支持两张图像的容量，同时保存的历史记录、严格的 replay matching 和原始 assertions 均保持不变。

由索引模型根据 Issue 内容生成。