Fix: brand push notifications with the configured PWA icon

The service worker hard-coded the notification icon and badge to the bundled /icon-192x192.png, so push notifications always showed the default Bulwark logo even when an admin had configured a custom PWA/favicon icon (which the manifest already honors via /api/pwa-icon).

Point both notifications at /api/pwa-icon/192, and make that endpoint fall back to the bundled default icon instead of returning 404 when no custom icon is set - so it always returns an app icon and the service worker (which can't run the custom-vs-default check itself) has a single stable URL.

public/sw.js

@@ -169,8 +169,10 @@ async function handlePush(event) {
   await self.registration.showNotification(title, {
     body,
     tag,
-    icon: `${BASE_PATH}/icon-192x192.png`,
-    badge: `${BASE_PATH}/icon-192x192.png`,
+    // Branded app icon via the PWA-icon endpoint (admin-configured, else the
+    // built-in default). The static /icon-192x192.png ignored admin branding.
+    icon: `${BASE_PATH}/api/pwa-icon/192`,
+    badge: `${BASE_PATH}/api/pwa-icon/192`,
     data,
     renotify: true,
   });
@@ -281,8 +283,8 @@ async function showMailtoFocusNotification(state) {
     await self.registration.showNotification(state.focusNotificationTitle || "Bulwark", {
       body: state.focusNotificationBody || "The request was opened in Bulwark. Click to bring it to the front.",
       tag: "bulwark-mailto-focus",
-      icon: `${BASE_PATH}/icon-192x192.png`,
-      badge: `${BASE_PATH}/icon-192x192.png`,
+      icon: `${BASE_PATH}/api/pwa-icon/192`,
+      badge: `${BASE_PATH}/api/pwa-icon/192`,
       data: { kind: "protocol-mailto-focus" },
       renotify: true,
     });