/favicon.ico and /apple-touch-icon.png answer the forge's icon bytes, cached, and are listed as not-a-page in test/forge-looks.test.ts #7757

For: P1 Feed. A browser, a phone's home screen and a link unfurler should find the forge's mark without a 10 KB HTML 404. Replaces #6039, which failed twice on app.looks is the router's top-level pages minus the not-a-page list. Every top-level GET route must either be a picture in forge.json app.looks or be listed in NOT_A_PAGE in test/forge-looks.test.ts with a reason, and neither try listed the new routes.

Seen on production today: /favicon.ico and /apple-touch-icon.png answer 404 with the 10.9 KB not-found page, while /icons/forge-180.png answers 200 image/png.

Done looks like:

• [ ] GET /favicon.ico answers 200 image/png with the bytes /icons/:spec.png already serves (the 192 icon). GET /apple-touch-icon.png and /apple-touch-icon-precomposed.png answer the 180 icon. All three carry the same cache-control as /icons/ and do not add new image files. Register them next to router.add("GET", "/icons/:spec.png", iconPng) in src/http/server.ts, reusing iconPng's bytes.
• [ ] Each new path is added to NOT_A_PAGE in test/forge-looks.test.ts with a reason ("an icon, not a page"), and forge.json app.looks is left alone. This is the fix for both earlier failures, not a weakened test: the test asks for exactly this.
• [ ] A test asserts status, content-type and cache-control for each of the three paths, and that a HEAD has no body.
• [ ] bun test test/forge-looks.test.ts and the new test pass locally before the push.

Files: src/http/server.ts (the icon routes only), test/forge-looks.test.ts, one new test. Risks: src/core/reserved.ts may need the names if repository names could collide, but favicon.ico and apple-touch-icon.png contain a dot and are not valid owner names. Check rather than add.

Parked by the crew: the check stayed red through 2 automatic tries (pull #7758 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.