fix: enhance branding configuration and public API endpoints for branding details

[chenyme]

Summary

Move frontend branding from build-time NEXT_PUBLIC_* variables to runtime config.yaml configuration.

• Add public branding and dynamic Web App Manifest APIs.
• Load branding once through the root BrandingProvider.
• Let React manage title, favicon, metadata, and manifest across client-side navigation.
• Remove static branding metadata and the build-time manifest that restored default DEEIX branding during route changes.
• Support both bundled same-origin deployments and separately deployed static frontends.
• Fall back to built-in branding after 3 seconds when the branding API is unavailable.
• Preserve dynamic root /manifest.webmanifest compatibility for existing PWA installations.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./...
• cd frontend && pnpm lint
• cd frontend && pnpm exec tsc --noEmit
• git diff --check
• cd frontend && pnpm build
• Not run; reason: frontend build was intentionally skipped per review request.

Screenshots, API examples, or logs

Verified that runtime branding remains the single title, favicon, and manifest source after client-side navigation.

New public endpoints:

GET /api/v1/branding
GET /api/v1/branding/manifest.webmanifest
GET /manifest.webmanifest

Configuration, migration, and compatibility notes

Branding configuration moves from frontend NEXT_PUBLIC_* variables to the root config.yaml:

branding:
  title: Example Chat
  short_name: Example
  description: Example Chat is a multi-model AI conversation system.
  logo_url: https://example.com/logo.svg
  favicon_url: https://example.com/favicon.ico
  pwa_icon_192_url: https://example.com/icon-192.png
  pwa_icon_512_url: https://example.com/icon-512.png
  pwa_maskable_icon_512_url: https://example.com/icon-maskable-512.png
  apple_touch_icon_180_url: https://example.com/apple-touch-icon-180.png

• Existing branding environment variables must be migrated to config.yaml.
• Brand changes require an application restart but no frontend or Docker image rebuild.
• Separated deployments still use NEXT_PUBLIC_API_BASE_URL to locate the backend.
• Separated deployments must configure server.cors_allow_origin and server.public_web_base_url.
• No database or schema migration is required.
• Installed PWA names and icons may remain browser-cached until the browser refreshes the manifest. Immediate verification may require reinstalling the PWA.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including the intentionally public branding endpoints and their limited response fields.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.