feat(models): refresh model capabilities from models.dev in the background

Capability tables are hand-maintained, so a model gains vision or a wider
context only when someone notices and edits the file. This adds a daily
sync that fills the gap for models already in the registry.

How it decides:

- Modalities (vision/pdf/audio/video) belong to the MODEL — every gateway
  serving glm-5.3-flash serves the same weights — so they are keyed by
  model id and shared. A majority of sources must declare one, which keeps
  out lone mis-declarations: minimax-m2.5 (1 of 45), glm-4.7 (1 of 44) and
  gpt-oss-120b (2 of 76) are text-only despite a reseller claiming vision.
- Context/output limits belong to the GATEWAY — each truncates differently
  (glm-5 ships as 202752/16384 on one host and 204800/131072 on another) —
  so they are keyed by provider + model and only the matching provider's
  own numbers are trusted.

Both layers are strictly additive and sit BELOW the hand-written tables,
which short-circuit first. A capability already true stays true.

Mechanics: worker thread (the 4MB parse would block the loop ~20ms),
ETag so an unchanged catalog costs one empty request, 60s startup delay,
30min backoff on failure, MODEL_CATALOG_SYNC=off to disable. Only the
~57KB delta is kept; lookups cost ~0.1us via an mtime-guarded cache.

capabilities.js is bundled into the browser through useModelCaps, so it
cannot import node:fs — the server injects the reader via
setCatalogSource() from instrumentation.

visionPatterns.js is the last resort: a model nobody has catalogued yet
still accepts images when its id says so (qwen3-vl-plus, glm-4.6v, llava),
with image-generation and embedding ids excluded.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

open-sse/providers/visionPatterns.js

@@ -0,0 +1,42 @@
+// Name-based vision detection — last resort when neither the catalog file nor
+// the capability tables know a model. Vendors put the modality in the id
+// ("qwen3-vl-plus", "glm-4.6v", "deepseek-v4-flash-vision-exp"), so a custom or
+// freshly released model still gets image input instead of silently dropping it.
+//
+// Only ever turns vision ON. Never used to turn a declared capability off.
+
+const SEP = "[-_/:.]";
+
+// Image GENERATION, video generation, and non-chat models also carry these
+// words but take no image input — checked first so they can never match.
+const NOT_VISION = new RegExp(
+  [
+    `(^|${SEP})(image|img)(${SEP}|$)`,
+    "stable-image", "gen[0-9]_image", "nanobanana", "imagine",
+    "t2v", "i2v", "flux", "dall", "sdxl", "diffusion",
+    "embed", "rerank", "guard", "moderation",
+    "tts", "stt", "whisper", "voice", "speech", "audio",
+  ].join("|"),
+  "i"
+);
+
+// Explicit modality words, plus the "<digit>v" suffix vendors use for vision
+// variants (glm-4.6v, glm-5v-turbo). The digit-v branch requires a dotted
+// version so the never-shipped `gpt-4v` cannot match.
+const VISION_NAME = new RegExp(
+  [
+    `(^|${SEP})(vision|vl|vlm|multimodal|omni|visual)(${SEP}|$)`,
+    `[0-9]\\.[0-9]+v(${SEP}|$)`,
+    `(^|${SEP})glm-[0-9]+v(${SEP}|$)`,
+    "(^|[-_/:.])(llava|pixtral|internvl|cogvlm|minicpm-v|moondream|idefics|fuyu)",
+  ].join("|"),
+  "i"
+);
+
+// Does this model id look like a vision model? Name signal only.
+export function looksLikeVisionModel(modelId) {
+  if (!modelId) return false;
+  const id = String(modelId).toLowerCase();
+  if (NOT_VISION.test(id)) return false;
+  return VISION_NAME.test(id);
+}