add public icon route + forwarded proxy trust; SPEC/AGENTS docs

app/main.py

@@ -48,8 +48,7 @@ def get_version_android():
     }
 
 
-@app.get("/img/token/{filename}")
-def get_icon(filename: str):
+def _serve_icon(filename: str):
     token_dir = ICON_DIR / "token"
     path = (token_dir / filename).resolve()
     if not path.is_file() or token_dir.resolve() not in path.parents:
@@ -57,6 +56,16 @@ def get_icon(filename: str):
     return FileResponse(path, media_type="image/png")
 
 
+@app.get("/img/token/{filename}")
+def get_icon(filename: str):
+    return _serve_icon(filename)
+
+
+@app.get("/public/img/token/{filename}")
+def get_public_icon(filename: str):
+    return _serve_icon(filename)
+
+
 @app.on_event("startup")
 def startup():
     db.init_db()