fix: hide backend URL from logo by fetching as blob

Logo images were exposing the backend API URL in the DOM via <img src>.
Now preloadLogo() fetches the image as a blob and serves it through
URL.createObjectURL(), so only blob: URLs appear in the page source.
Blob is invalidated on logo upload/delete.

src/components/layout/AppShell/AppHeader.tsx

@@ -89,7 +89,7 @@ export function AppHeader({
     queryFn: async () => {
       const data = await brandingApi.getBranding();
       setCachedBranding(data);
-      preloadLogo(data);
+      await preloadLogo(data);
       return data;
     },
     initialData: getCachedBranding() ?? undefined,

src/components/layout/AppShell/DesktopSidebar.tsx

@@ -58,7 +58,7 @@ export function DesktopSidebar({
     queryFn: async () => {
       const data = await brandingApi.getBranding();
       setCachedBranding(data);
-      preloadLogo(data);
+      await preloadLogo(data);
       return data;
     },
     initialData: getCachedBranding() ?? undefined,