Use authenticated brands proxy for repository icons

[manuveli]

Summary

The HACS dashboard shows "icon not available" for custom integrations that ship inline brand assets (a feature introduced in Home Assistant 2026.3). Root cause is a combination of three things:

• The homeassistant-frontend submodule is pinned to 3ffbd435 (2025-01-09) — pre-brands-proxy.
• At that revision, brandsUrl({...}) still returns https://brands.home-assistant.io/_/{domain}/icon.png. That CDN no longer accepts new custom-integration submissions (see the brands-proxy API blog post), so custom-integration icons 404.
• The dashboard passes useFallback: true — a parameter that has since been removed from upstream BrandsOptions, so a naive submodule bump breaks the TypeScript compile.

Changes

1. Bump homeassistant-frontend submodule to current upstream master — brings in the new brands-url.ts that returns /api/brands/integration/{domain}/icon.png?token=…, along with fetchAndScheduleBrandsAccessToken / clearBrandsTokenRefresh exports.
2. Remove useFallback: true from the brandsUrl({...}) call in src/dashboards/hacs-dashboard.ts — the field no longer exists on BrandsOptions. Fallback is now the HA backend's job (stale-while-revalidate through the proxy).
3. Fetch and schedule the brands access token from the dashboard's bundle. Module-level _brandsAccessToken in brands-url.ts is bundle-scoped, so HACS must populate its own copy; upstream's fetchAndScheduleBrandsAccessToken silently swallows failures on older HA backends. Clear the refresh interval in disconnectedCallback to avoid leaking the setInterval when the panel unmounts.

Fixes hacs/integration#5171
Fixes hacs/integration#5223

A companion PR in the integration repo (hacs/integration) updates the HACS Update entity's entity_picture to use the same authenticated proxy path.

Test plan

• script/bootstrap && script/build compiles clean (CI via .github/workflows/test.yml).
• Against HA ≥ 2026.3 with HACS + a custom integration shipping brand/icon.png inline: downloads table shows real icons; rendered <img> has src=/api/brands/integration/{domain}/icon.png?token=….
• Dark-mode toggle still flows through darkOptimized (filename prefixed with dark_).
• Against HA < 2026.3 (no brands/access_token WS command): dashboard renders without thrown errors — fetchAndScheduleBrandsAccessToken catches silently.

🤖 Generated with Claude Code

[manuveli]

@ludeeus sorry for pinging you, but any chance to take a look at this PR and additionally hacs/integration#5228? We would love to have icons back for integrations.

It's fixing hacs/integration#5171 and hacs/integration#5223

Hope to hear from you!

[piitaya]

I don't think that will work. If the integration is not installed, the local image will not be available, right?

[ludeeus]

That is correct @piitaya.
There is also a lot that will not work with just bumping the core frontend.
I plan on working on it this weekend.

[manuveli]

You are right, but that's why I have another PR: hacs/integration#5228

[piitaya]

The solution I had in mind : a HACS endpoint (/api/hacs/repository/{id}/icon.png) that fetches brand/icon.png via the authenticated GitHub session, caches it under .storage/hacs.icons/. The main issue is how to invalidate the cache.

@manuveli This PR is only about update entities (so, only for installed integration).