feat(acp): rich content support — images, resources, tool locations

[bug-ops]

Summary

Implements Epic #784 — Rich Content Support for ACP.

4.1 Multi-modal prompts

• Image content blocks decoded from base64 and forwarded to LLM providers as attachments
• Embedded resource text wrapped in <resource> markers and appended to prompt
• Audio and ResourceLink blocks skipped (no provider support)

4.2 Tool locations

• LoopbackEvent::ToolOutput extended with locations: Option<Vec<String>>
• Mapped to acp::ToolCallLocation for IDE file navigation

4.3 Thinking chunks

• Already implemented — verified, no changes needed

Security hardening

• 20 MiB base64 size guard before decode (DoS prevention)
• MIME whitelist: jpeg, png, gif, webp only
• Resource text isolation via XML markers (prompt injection mitigation)

Test plan

• 8 new unit tests for image extraction, resource wrapping, tool locations, edge cases
• Integration tests pass (2 ACP e2e tests)
• All 2605 workspace tests pass
• Security review: size guard, MIME whitelist, resource isolation
• Performance review: no blockers

Closes #784