feat(health): local icon cache /api/icons/:slug.png (no CDN leak)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/api/routes/icons.js

@@ -0,0 +1,14 @@
+import { Router } from 'express';
+import { getIcon, validSlug } from '../../health/icons.js';
+export const router = Router();
+router.get('/:file', async (req, res) => {
+  const slug = req.params.file.replace(/\.png$/, '');
+  if (!validSlug(slug)) return res.status(400).json({ error: { code: 'bad_slug' } });
+  try {
+    const buf = await getIcon(slug);
+    if (!buf) return res.status(404).end();
+    res.set('Content-Type', 'image/png').set('Cache-Control', 'public, max-age=86400').send(buf);
+  } catch (e) {
+    res.status(e.message === 'invalid slug' ? 400 : 502).end();
+  }
+});