fix: remove x-oa-site header and siteId for site-bound API keys, unify brand blue icon

[christopherjnelson]

Summary

This PR addresses crucial feedback discovered during manual live qualification testing:

1. Strip x-oa-site Header & Remove siteId

• Live testing revealed Open Analytics Read Keys (created per site in Settings → API) are strictly bound to one site.
• The API explicitly rejects x-oa-site when authenticating with an API key:

  Bad request - please check your parameters: X-OA-Site is not accepted with an API key: the key is bound to one site

• Removed x-oa-site header and the siteId parameter from site.get, all 7 analytics operations, and both revenue operations.
• Cleanly deleted the unused getSites listSearch method and its test fixture.
• In n8n, the credential itself now seamlessly scopes all operations to that specific site with zero parameter friction.

2. Unify Brand Blue Icon Across Light & Dark Themes

• Replaced the white dark-mode glyph in icons/openanalytics.dark.svg with the official brand blue fill (#296FF0), ensuring the colored glyph renders consistently across both light and dark themes.
• Updated docs/branding.md asset hashes.

3. Verification

• 27 unit and contract tests passing across 4 test suites.
• All 10 verification gates passed cleanly:
  • npm run format:check
  • npm run lint (0 errors / 0 warnings)
  • npm run typecheck
  • npm test
  • npm run build
  • npm run scan:source
  • npm run release:check
  • npm run package:check
  • npm run smoke:load
  • npm run smoke:install