feat(health): local icon cache /api/icons/:slug.png (no CDN leak)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server.js

@@ -6,6 +6,7 @@ import { mountApi } from './lib/api/index.js';
 import * as queue from './lib/jobs/queue.js';
 import { registerWorkers } from './lib/jobs/index.js';
 import { router as ingestRouter } from './lib/api/routes/ingest.js';
+import { router as iconsRouter } from './lib/api/routes/icons.js';
 import { startCron } from './lib/cron/index.js';
 
 const VERSION = '2.0.0-alpha.7';
@@ -22,6 +23,10 @@ export function createApp() {
   // and need access to req.rawBody captured above.
   app.use('/api/ingest', ingestRouter);
 
+  // /api/icons/* bypasses agentOrOwner — <img> tags can't send bearer headers;
+  // slugs are sanitized to [a-z0-9-] to prevent path traversal.
+  app.use('/api/icons', iconsRouter);
+
   app.get('/health', async (_req, res) => {
     let db_ok = false;
     try {