Use the new app icon everywhere

Source artwork committed as assets/app-icon-source.jpeg (1024x1024 navy
rounded square) and scripts/make-icons.mjs rewritten to render every icon
from it with headless Chromium:

- The master is masked at full resolution first (a rounded rect 4px inside
  the artwork's own radius), so the JPEG's anti-aliased white edge never
  survives and small sizes downscale with clean alpha.
- PWA icons (192/512) and favicon-32 keep the rounded square with
  transparent corners; apple-touch 180/167/152 are full-bleed (iOS paints
  transparency black) with the artwork zoomed 20% to crop its corners;
  maskable-512 keeps the artwork inside the 80% safe circle on a matching
  navy field.
- iOS splash screens regenerated with the new mark.
- app/favicon.ico regenerated (PNG payload in an ICO container); the old
  app/icon.svg removed so the browser tab can't fall back to it.
- Install sheet's app card now shows the real icon, so the home-screen
  icon is recognisable.
- Service worker CACHE_VERSION bumped to freezmo-v3 so installed clients
  pick up the new assets.
- README updated (source artwork + script description).

Verified: pwa 16/16, install sheet 64/64, final ux 12/12, key gate 49/49,
zoom 6/6; every icon route serves 200 and the manifest/head reference the
new files.

README.md

@@ -417,14 +417,15 @@ What's included:
 | Piece | Detail |
 | --- | --- |
 | `app/manifest.ts` | `display: standalone`, portrait, theme/background colours, app shortcuts |
-| Icons | 192/512 px, a maskable 512 px icon, and 180/167/152 px `apple-touch-icon`s |
+| Icons | 192/512 px, a maskable 512 px icon, and 180/167/152 px `apple-touch-icon`s, all rendered from `assets/app-icon-source.jpeg` |
 | iOS meta | `apple-mobile-web-app-capable`, `-title`, `-status-bar-style`, `viewport-fit=cover` |
 | Service worker | `public/sw.js`, **production only**: cached app shell, stale-while-revalidate for static assets, network-first navigations with an `/offline` fallback. `/api/*` is never cached |
 | Offline page | `/offline` — "your decks are still here, reconnect to generate" |
 | Safe areas | `pb-safe` / `pt-safe` utilities plus `pb-tabbar` so nothing hides behind the tab bar |
 
-The icons are generated by `scripts/make-icons.mjs` (headless Chromium); it is a one-off tool and
-is not part of the app's dependencies.
+The icons are generated by `scripts/make-icons.mjs` from `assets/app-icon-source.jpeg` (headless
+Chromium); it is a one-off tool and is not part of the app's dependencies. It also writes
+`app/favicon.ico`, the Next.js file convention for the browser tab.
 
 ## Security notes
 
@@ -574,9 +575,11 @@ lib/
 public/
   sw.js                  service worker (production only)
   icons/                 PWA + iOS icons and splash screens
+assets/
+  app-icon-source.jpeg   master artwork the icons are rendered from
 scripts/
   copy-pdf-worker.mjs   copies the pdf.js worker to /public (runs on predev/prebuild)
-  make-icons.mjs        regenerates the PWA/iOS icons (one-off tool)
+  make-icons.mjs        regenerates the PWA/iOS icons from the master (one-off tool)
 ```
 
 ---