feat: proper logo, favicon, and pwa icons

- replace placeholder house svg with clean geometric house mark
  on indigo-700 (#4338CA) — roof triangle, body, door cutout
- add favicon.svg with prefers-color-scheme dark variant
- add icon-16/32 sizes; regenerate all pngs from svg via sharp
- update BrandMark component to use inline svg house instead of 'f'
- wire favicon + sized pngs into layout metadata
- fix middleware to allow icon/manifest/favicon paths without auth
  (android launcher fetches icons in a cookieless system context)
- fix getCurrentSession() to redirect to /login instead of throwing
  when session cookie is stale/invalid

src/app/layout.tsx

@@ -54,6 +54,11 @@ export const metadata: Metadata = {
     title: "famapp",
   },
   icons: {
+    icon: [
+      { url: "/favicon.svg", type: "image/svg+xml" },
+      { url: "/icon-32.png", sizes: "32x32", type: "image/png" },
+      { url: "/icon-16.png", sizes: "16x16", type: "image/png" },
+    ],
     apple: "/icon-180.png",
   },
 };

src/components/brand-mark.tsx

@@ -1,12 +1,23 @@
 import { cn } from "@/lib/utils";
 
 export function BrandMark({ size = "md", className }: { size?: "sm" | "md"; className?: string }) {
+  const iconSize = size === "sm" ? 14 : 17;
   return (
     <span
       className={cn("brand-mark", size === "sm" && "brand-mark-sm", className)}
       aria-hidden="true"
     >
-      f
+      <svg
+        viewBox="0 0 24 24"
+        xmlns="http://www.w3.org/2000/svg"
+        width={iconSize}
+        height={iconSize}
+        fill="currentColor"
+      >
+        <polygon points="12,2 1,12 23,12" />
+        <rect x="3.5" y="11" width="17" height="12" />
+        <rect x="9.5" y="16" width="5" height="7" rx="1" style={{ fill: "var(--ink)" }} />
+      </svg>
     </span>
   );
 }

src/lib/session.ts

@@ -1,4 +1,5 @@
 import { eq } from "drizzle-orm";
+import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { db } from "@/lib/db";
 import { householdMembers, households, users } from "@/modules/_core/schema";
@@ -13,7 +14,7 @@ export interface CurrentSession {
 
 export async function getCurrentSession(): Promise<CurrentSession> {
   const session = await auth();
-  if (!session?.user?.id) throw new Error("Not authenticated");
+  if (!session?.user?.id) redirect("/login");
 
   const [row] = await db
     .select({

src/middleware.ts

@@ -1,8 +1,8 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { consume } from "@/lib/rate-limit";
 
-const PUBLIC_PREFIXES = ["/api/auth/", "/s/"];
-const PUBLIC_PATHS = new Set(["/login"]);
+const PUBLIC_PREFIXES = ["/api/auth/", "/s/", "/icon-", "/favicon"];
+const PUBLIC_PATHS = new Set(["/login", "/manifest.webmanifest", "/offline.html"]);
 const SESSION_COOKIE_NAMES = ["authjs.session-token", "__Secure-authjs.session-token"];
 
 // Token-prefix length used as part of the rate-limit bucket key.