feat(api): add logo upload/serve/delete routes with tests

Add branding API at /api/v1/settings/logo supporting:
- POST: admin uploads PNG/SVG/JPEG (max 500KB), auto-converts to 128x128 PNG
- GET: public endpoint serves custom logo (404 if none)
- DELETE: admin removes custom logo

Includes 13 integration tests covering upload, conversion, size/type
validation, auth enforcement, resize, and idempotent deletion.

apps/api/src/plugins/auth.ts

@@ -580,6 +580,7 @@ const PUBLIC_PATHS = [
   "/api/auth/",
   "/api/v1/download/",
   "/api/v1/jobs/",
+  "/api/v1/settings/logo",
 ];
 
 function isPublicRoute(url: string): boolean {