Finish the Cairn OBS rename through services, docs, and assets

The rename commit before this one covered module paths and the obvious
user-facing strings; this is the rest of it -- the places where "sentry"
was a default value, a filename, or a picture rather than a word in a
sentence.

Defaults that changed: CLICKHOUSE_DATABASE (sentry -> cairnobs),
POSTGRES_DATABASE (sentry_metadata -> cairnobs_metadata), and
POSTGRES_USERNAME (sentry -> cairnobs), across api/alerting/ingest and
the enterprise binaries, plus the compose files and migrate scripts that
create those objects. These are *defaults*, so a deployment that sets
them explicitly is unaffected -- but any deployment relying on the old
defaults must have its environment updated before it picks this up, or
it will come up pointing at a database that doesn't exist.

Also: the light-mode logo variants (the dark ones existed alone, so the
landing page and sidebar rendered a dark mark on a light background),
regenerated favicons, and the docs/README/threat-model prose that still
said Sentry.

api/Dockerfile

@@ -1,7 +1,7 @@
 # Build context must be the repo root (sentry/), since this needs both
 # api/ and proto/ (api now speaks gRPC to /search, using proto's checked-in
 # Go bindings via the `replace` directive in api/go.mod):
-#   docker build -f api/Dockerfile -t sentry-api .
+#   docker build -f api/Dockerfile -t cairnobs-api .
 
 FROM golang:1.25-alpine AS builder
 WORKDIR /src

api/README.md

@@ -46,7 +46,7 @@ Environment variables (see `internal/config/config.go`):
 |---|---|---|
 | `HTTP_LISTEN_ADDR` | `:8080` | |
 | `CLICKHOUSE_ADDR` | `localhost:9000` | Native protocol port |
-| `CLICKHOUSE_DATABASE` / `_USERNAME` / `_PASSWORD` | `sentry` / `default` / `` | |
+| `CLICKHOUSE_DATABASE` / `_USERNAME` / `_PASSWORD` | `cairnobs` / `default` / `` | |
 | `SEARCH_GRPC_ADDR` | `localhost:50052` | Must match `/search`'s `GRPC_LISTEN_ADDR` |
 | `QUERY_TIMEOUT_SECONDS` | `30` | Per-request timeout |
 | `CORS_ALLOWED_ORIGIN` | `*` | Wide open by default since there's no auth yet; tighten together |
@@ -66,7 +66,7 @@ go test ./...
 
 ```sh
 # from the repo root, not api/
-docker build -f api/Dockerfile -t sentry-api .
+docker build -f api/Dockerfile -t cairnobs-api .
 ```
 
 ## Testing notes

api/dashboards/store_integration_test.go

@@ -32,7 +32,7 @@ func integrationStore(t *testing.T) (*Store, *pgxpool.Pool) {
 		t.Skip("DASHBOARDS_TEST_POSTGRES_ADDR not set -- skipping live-Postgres integration test")
 	}
 	password := os.Getenv("DASHBOARDS_TEST_POSTGRES_PASSWORD")
-	dsn := fmt.Sprintf("postgres://sentry:%s@%s/sentry_metadata", password, addr)
+	dsn := fmt.Sprintf("postgres://cairnobs:%s@%s/cairnobs_metadata", password, addr)
 	pool, err := pgxpool.New(context.Background(), dsn)
 	if err != nil {
 		t.Fatalf("opening pool: %v", err)

api/internal/config/config.go

@@ -37,8 +37,8 @@ type LocalAuthConfig struct {
 	SessionTTL time.Duration
 	// CookieDomain empty means a host-only cookie (fine for local dev,
 	// where web/api are both localhost:<port>). Set to e.g.
-	// ".sentry.example.com" in production so the cookie is also sent to
-	// api.sentry.example.com/alerting.sentry.example.com.
+	// ".cairnobs.example.com" in production so the cookie is also sent to
+	// api.cairnobs.example.com/alerting.cairnobs.example.com.
 	CookieDomain string
 	// CookieSecure defaults true (never sent over plain HTTP) --
 	// deliberately opt-out via LOCAL_AUTH_COOKIE_SECURE=false, only
@@ -108,14 +108,14 @@ func Load() (Config, error) {
 		HTTPListenAddr: getenv("HTTP_LISTEN_ADDR", ":8080"),
 		ClickHouse: ClickHouseConfig{
 			Addr:     getenv("CLICKHOUSE_ADDR", "localhost:9000"),
-			Database: getenv("CLICKHOUSE_DATABASE", "sentry"),
+			Database: getenv("CLICKHOUSE_DATABASE", "cairnobs"),
 			Username: getenv("CLICKHOUSE_USERNAME", "default"),
 			Password: getenv("CLICKHOUSE_PASSWORD", ""),
 		},
 		Postgres: PostgresConfig{
 			Addr:     getenv("POSTGRES_ADDR", "localhost:5432"),
-			Database: getenv("POSTGRES_DATABASE", "sentry_metadata"),
-			Username: getenv("POSTGRES_USERNAME", "sentry"),
+			Database: getenv("POSTGRES_DATABASE", "cairnobs_metadata"),
+			Username: getenv("POSTGRES_USERNAME", "cairnobs"),
 			Password: getenv("POSTGRES_PASSWORD", ""),
 		},
 		// Search service's gRPC address (see /search) -- default matches

api/localauth/store_integration_test.go

@@ -35,7 +35,7 @@ func integrationStore(t *testing.T) *Store {
 		t.Skip("LOCALAUTH_TEST_POSTGRES_ADDR not set -- skipping live-Postgres integration test")
 	}
 	password := os.Getenv("LOCALAUTH_TEST_POSTGRES_PASSWORD")
-	dsn := fmt.Sprintf("postgres://sentry:%s@%s/sentry_metadata", password, addr)
+	dsn := fmt.Sprintf("postgres://cairnobs:%s@%s/cairnobs_metadata", password, addr)
 	pool, err := pgxpool.New(context.Background(), dsn)
 	if err != nil {
 		t.Fatalf("opening pool: %v", err)
@@ -285,3 +285,4 @@ func TestIntegrationGetPasswordHashByID(t *testing.T) {
 		t.Errorf("GetPasswordHashByID for an unknown ID: err = %v, want ErrNotFound", err)
 	}
 }
+