Draw apps with Simple Icons instead of fetched favicons

The favicon service was wrong as often as it was right: a sign-in page's
icon for anything behind a login, nothing at all for a private host, and
both answers cached past any way of asking again. Refreshing could not
fix it, because the staleness was not local. Now every mark is.

Each app is its brand glyph in white on a round tile, coloured from
Tailwind's 500s by hashing the host - you find things by their colour, so
one that moved every launch would be worse than none. A host with no
glyph gets its initial in the same tile.

Matching tries the registrable name first, since a self-hosted tool is
nearly always on a subdomain of its vendor - aputure.odoo.com is Odoo,
not Aputure. A short table covers what a domain cannot answer, which is
most of Google.

The build reduces Simple Icons' 15MB of SVGs to one 4.5MB map in public/,
fetched once rather than parsed into the bundle at every start; the
bundle stays at 233KB. It is generated on every build, so never committed
and never stale.

Traffic lights are offset to sit inside the window margin rather than
crowding its edge.

docs/superpowers/specs/2026-09-01-work-app-design.md

@@ -250,6 +250,30 @@ the only thing that clears it; nothing else does, because nothing else means you
 it. Counts live in memory rather than `apps.json`: a restart reloads every app anyway, and
 a number that survived would be a claim the app can no longer support.
 
+## App marks
+
+Each app is drawn as its brand glyph in white on a round tile of its own colour, from
+**Simple Icons** (CC0, ~3,400 marks). A host with no glyph gets its initial in the same
+tile, so a private tool sits in the row looking like it belongs.
+
+This replaced Google's favicon service, which was wrong as often as it was right: it
+returned a sign-in page's icon for anything behind a login, nothing at all for a private
+host, and cached both answers past any way of asking again. A "refresh icons" button could
+not fix that, because the staleness was not local.
+
+Colours are Tailwind 500s, chosen by hashing the host rather than at random — you find
+things by their colour, and a colour that moved every launch would be worse than none.
+
+The build turns Simple Icons' 15MB of SVG files into one 4.5MB map of slug to path data,
+written to `public/` so it is fetched once at runtime rather than parsed into the JS
+bundle at every start. The bundle stays at 233KB. The map is generated by `npm run icons`,
+which `npm run build` runs, so it is never committed and never stale.
+
+Matching a host to a glyph tries the registrable name first — `example.odoo.com` is Odoo,
+not Aputure — because a self-hosted tool is nearly always on a subdomain of its vendor. A
+short table handles the ones a domain cannot answer, which is most of Google: `google.com`
+says only that it is Google, not which of a dozen products.
+
 ## The window
 
 There is no title bar and no toolbar, so in a normal window the shell keeps a 6px margin