[SandObserver]

Summary

• Add GET /api/icons/cdn, which fetches an icon from the dashboard-icons catalogue once and holds the bytes in memory for 24 hours, bounded to 300 entries and 512 KB per file.
• Sanitise upstream SVG before serving it, sniff PNG bytes, and send X-Content-Type-Options: nosniff; a body that is not the declared image type is treated as missing.
• Cache a 404 so a name the catalogue does not have is not refetched on every load, and never cache any other upstream failure.
• Add a binary option to fetchJSON that resolves the raw Buffer and content type, so image bytes are not corrupted by the utf8 conversion.
• Put the proxy URLs ahead of the direct jsDelivr URLs in iconChain, keeping the CDN links as the fallback.
• Restrict the requested name to the catalogue's slug form, so nothing else reaches a CDN path.

Testing
All green, apart from the Docker build smoke test, which needs a local Docker daemon. Added 8 route tests covering the single outbound fetch, the negative cache, refused names, SVG sanitising and PNG sniffing, and updated the icon-chain tests.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.