Finish the Cairn OBS rename through services, docs, and assets

The rename commit before this one covered module paths and the obvious
user-facing strings; this is the rest of it -- the places where "sentry"
was a default value, a filename, or a picture rather than a word in a
sentence.

Defaults that changed: CLICKHOUSE_DATABASE (sentry -> cairnobs),
POSTGRES_DATABASE (sentry_metadata -> cairnobs_metadata), and
POSTGRES_USERNAME (sentry -> cairnobs), across api/alerting/ingest and
the enterprise binaries, plus the compose files and migrate scripts that
create those objects. These are *defaults*, so a deployment that sets
them explicitly is unaffected -- but any deployment relying on the old
defaults must have its environment updated before it picks this up, or
it will come up pointing at a database that doesn't exist.

Also: the light-mode logo variants (the dark ones existed alone, so the
landing page and sidebar rendered a dark mark on a light background),
regenerated favicons, and the docs/README/threat-model prose that still
said Sentry.

alerting/Dockerfile

@@ -1,7 +1,7 @@
 # alerting never needs /proto (it talks to /api over plain HTTP, no gRPC),
 # so unlike api/ingest/search this build context is just alerting/ itself,
 # same shape as cli/Dockerfile:
-#   docker build -f alerting/Dockerfile -t sentry-alerting alerting/
+#   docker build -f alerting/Dockerfile -t cairnobs-alerting alerting/
 FROM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY . .

alerting/README.md

@@ -11,7 +11,7 @@ correctness properties this implementation follows exactly).
 POSTGRES_PASSWORD=cairnobs-dev-only API_QUERY_URL=http://localhost:8080 go run ./cmd/alerting
 ```
 
-Talks to the same `sentry_metadata` Postgres database as `/api`
+Talks to the same `cairnobs_metadata` Postgres database as `/api`
 (different tables — see `/metadata/README.md`), and to `/api`'s
 `POST /query` over plain HTTP for rule evaluation. Never connects to
 ClickHouse or Tantivy directly.
@@ -48,8 +48,8 @@ only, not separate delivery paths.
 |---|---|
 | `HTTP_LISTEN_ADDR` | `:8081` |
 | `POSTGRES_ADDR` | `localhost:5432` |
-| `POSTGRES_DATABASE` | `sentry_metadata` |
-| `POSTGRES_USERNAME` | `sentry` |
+| `POSTGRES_DATABASE` | `cairnobs_metadata` |
+| `POSTGRES_USERNAME` | `cairnobs` |
 | `POSTGRES_PASSWORD` | (empty — must be set) |
 | `API_QUERY_URL` | `http://localhost:8080` |
 | `CORS_ALLOWED_ORIGIN` | `*` |
@@ -94,5 +94,5 @@ go test ./...
 ```
 
 ```sh
-docker build -f Dockerfile -t sentry-alerting .   # context is alerting/, not the repo root -- no /proto needed
+docker build -f Dockerfile -t cairnobs-alerting .   # context is alerting/, not the repo root -- no /proto needed
 ```

alerting/internal/config/config.go

@@ -72,8 +72,8 @@ func Load() (Config, error) {
 		HTTPListenAddr: getenv("HTTP_LISTEN_ADDR", ":8081"),
 		Postgres: PostgresConfig{
 			Addr:     getenv("POSTGRES_ADDR", "localhost:5432"),
-			Database: getenv("POSTGRES_DATABASE", "sentry_metadata"),
-			Username: getenv("POSTGRES_USERNAME", "sentry"),
+			Database: getenv("POSTGRES_DATABASE", "cairnobs_metadata"),
+			Username: getenv("POSTGRES_USERNAME", "cairnobs"),
 			Password: getenv("POSTGRES_PASSWORD", ""),
 		},
 		APIQueryURL: getenv("API_QUERY_URL", "http://localhost:8080"),

alerting/internal/sessioncheck/sessioncheck_integration_test.go

@@ -37,7 +37,7 @@ func integrationPool(t *testing.T) *pgxpool.Pool {
 		t.Skip("SESSIONCHECK_TEST_POSTGRES_ADDR not set -- skipping live-Postgres integration test")
 	}
 	password := os.Getenv("SESSIONCHECK_TEST_POSTGRES_PASSWORD")
-	dsn := fmt.Sprintf("postgres://sentry:%s@%s/sentry_metadata", password, addr)
+	dsn := fmt.Sprintf("postgres://cairnobs:%s@%s/cairnobs_metadata", password, addr)
 	pool, err := pgxpool.New(context.Background(), dsn)
 	if err != nil {
 		t.Fatalf("opening pool: %v", err)