fix: return PNG for img-tag embeds on logo/pals endpoint
When <img> tags request pals.aesthetic.computer, the Accept header
prefers image/* — detect this and return raw PNG instead of HTML.
Also adds explicit CORS headers on the PNG response for cross-origin
embedding (Auth0 login pages, etc.).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>