#2473 MCP: opt-in cached image previews and authenticated downloads

Descripción

## Summary

Related: #2130 and #2343.

An MCP image result currently becomes text describing an unseen picture. This opt-in implementation passes supported raster results through existing vision preparation and gives the web chat a preview and authenticated download link. SHA-256 cache references survive refreshes and subsequent turns without storing base64 in localStorage.

**Overlap with #2343:** that PR already implements image-to-model delivery and client-side base64 lifting. This is an alternative cache-based transport, with persistent references and download support. The changes touch the same code and must be reconciled before merging. Client-side base64 lifting is not included here.

## What changed

- Enable with `"mcp": {"image_results": true}`; disabled by default. Default text results and stream result fields remain unchanged.
- Cache PNG/JPEG/WebP only, by SHA-256 beside the run configuration. Reject invalid base64, unsupported media and arbitrary file references. Four images per result, each capped at 24 million base64 characters (about 18 MB decoded).
- Downloads use existing API authentication, basename checks, raster MIME types, nosniff and same-origin resource policy. The browser fetches using authorization headers and downloads through Blob URLs.
- Show previews outside collapsed tool details. Reclaim ready/pending Blob URLs on New chat and pagehide; rehydrate on BFCache restoration.
- Forward images through the existing vision path when configured, otherwise preserve the text fallback and user-visible preview. Cache write failure preserves the tool text result. Text remains subject to max_result_chars.

## Validation

- Main base: 296b59d2. 25 existing MCP tests plus 12 media/compatibility tests passed using mock engines without loading GPU models.
- Tests cover cache deduplication and byte preservation, invalid content and caps, authenticated delivery and traversal refusal, cached-history resolution, stream metadata/vision dispatch, text truncation, cache write failure, and unchanged default text/event fields.
- `node --check serve/web/app.js` and `git diff --check` passed.
- Against this branch’s mock server, a saved 1024px PNG preview rendered within a 390px viewport, and its actual download matched the source SHA-256. This is desktop browser viewport testing, not physical iPhone/Safari testing or a new generation benchmark.

## Extra notes

No C++/CUDA/HIP/SYCL files changed. ComfyUI installation, GPU coordination, search providers and general mobile layout are outside this PR. Cache retention is manual; deleting cached files invalidates old references. See docs/MCP_IMAGES.md.