fix(wacli): bridge downloaded images into multimodal input

docs/channels.md

@@ -30,3 +30,10 @@ store_dir = "/path/to/wacli-store"
 Newer wacli webhook payloads can carry the resolved `ChatName`. OpenPRX also
 uses `store_dir/wacli.db` as a read-only fallback for group titles when a
 webhook payload does not include that field.
+
+For inbound image understanding, run wacli sync with `--download-media` and
+configure `store_dir`. The webhook arrives before wacli's asynchronous media
+download completes, so OpenPRX briefly waits for the matching `local_path`,
+copies the image into its workspace-owned media store with the configured
+`[multimodal].max_image_size_mb` limit, and then sends it through the normal
+multimodal provider path. Source paths outside `store_dir` are rejected.

docs/configuration.md

@@ -117,6 +117,7 @@ allowed_from = ["uuid:your-uuid"]
 webhook_listen = "127.0.0.1:16868"
 webhook_path = "/wacli"
 webhook_secret = "replace-with-secret"
+store_dir = "/path/to/wacli-store" # required for group-title fallback and inbound downloaded images
 
 [heartbeat]
 interval_minutes = 30

src/channels/mod.rs

@@ -5259,18 +5259,25 @@ pub async fn start_channels_with_config(
     }
 
     if let Some(ref wc) = config.channels_config.wacli {
-        channels.push(Arc::new(WacliChannel::new(wacli::WacliChannelConfig {
-            webhook_listen: wc.webhook_listen.clone(),
-            webhook_path: wc.webhook_path.clone(),
-            webhook_secret: wc.webhook_secret.clone(),
-            allow_unsigned_loopback: wc.allow_unsigned_loopback,
-            allowed_from: wc.allowed_from.clone(),
-            cli_path: wc.cli_path.clone(),
-            store_dir: wc.store_dir.clone(),
-            bot_jid: wc.bot_jid.clone(),
-            bot_number: wc.bot_number.clone(),
-            bot_lid: wc.bot_lid.clone(),
-        })));
+        let (_, max_image_size_mb) = config.multimodal.effective_limits();
+        channels.push(Arc::new(
+            WacliChannel::new(wacli::WacliChannelConfig {
+                webhook_listen: wc.webhook_listen.clone(),
+                webhook_path: wc.webhook_path.clone(),
+                webhook_secret: wc.webhook_secret.clone(),
+                allow_unsigned_loopback: wc.allow_unsigned_loopback,
+                allowed_from: wc.allowed_from.clone(),
+                cli_path: wc.cli_path.clone(),
+                store_dir: wc.store_dir.clone(),
+                bot_jid: wc.bot_jid.clone(),
+                bot_number: wc.bot_number.clone(),
+                bot_lid: wc.bot_lid.clone(),
+            })
+            .with_media_artifacts(
+                crate::media::MediaArtifactOwner::for_workspace(&config.workspace_dir),
+                max_image_size_mb.saturating_mul(1024 * 1024),
+            ),
+        ));
     }
 
     if let Some(ref nc) = config.channels_config.nextcloud_talk {