2af1671891
Add GET /api/branding/logo as a public endpoint that proxies logo bytes from S3, and change /api/branding to return logoUrl: "/api/branding/logo" instead of calling getPresignedGetUrl(). Eliminates mixed-content warnings when the branding context is consumed on unauthenticated pages (portal, login). Co-Authored-By: Paperclip <noreply@paperclip.ing>