v0.30.2: Report geo-restriction + logo/favicon update + Hub geo auth

- Add GeoRestrictionReport to report types and builder, so Hub can
  display geo-blocking status on customer detail pages
- Update all 5 BuildReport() call sites with new geoRestriction param
- Add /api/geo/ to selfUpdateAuthMiddleware (Hub Bearer token auth)
- Replace embedded logo SVG with updated logo.svg (white text variant)
- Add FelhomFaviconSVG constant + /static/favicon.svg route
- Update layout.html and catchall.html favicon links

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/report/builder.go

@@ -30,6 +30,7 @@ func BuildReport(
 	metricsStore *metrics.MetricsStore,
 	version string,
 	storagePaths []settings.StoragePath,
+	geoRestriction *settings.GeoRestriction,
 	logger *log.Logger,
 ) *Report {
 	debug := cfg.Logging.Level == "debug"
@@ -153,6 +154,23 @@ func BuildReport(
 	// App telemetry (metrics + log scan)
 	r.AppTelemetry = buildAppTelemetrySection(stackMgr, metricsStore, logger)
 
+	// Geo-restriction status
+	if geoRestriction != nil {
+		gr := &GeoRestrictionReport{
+			Enabled:          geoRestriction.Enabled,
+			AllowedCountries: geoRestriction.AllowedCountries,
+			LastSync:         geoRestriction.LastSync,
+			LastSyncError:    geoRestriction.LastSyncError,
+		}
+		if len(geoRestriction.AppOverrides) > 0 {
+			gr.AppOverrides = make(map[string]GeoAppOverrideReport, len(geoRestriction.AppOverrides))
+			for k, v := range geoRestriction.AppOverrides {
+				gr.AppOverrides[k] = GeoAppOverrideReport{AllowedCountries: v.AllowedCountries}
+			}
+		}
+		r.GeoRestriction = gr
+	}
+
 	if debug && logger != nil {
 		logger.Printf("[DEBUG] BuildReport: complete — containers=%d, health=%s, deployed=%d, available=%d, app_telemetry=%d",
 			r.Containers.Total, r.Health.Status, len(r.Stacks.Deployed), len(r.Stacks.Available), len(r.AppTelemetry))