Finish the Cairn OBS rename through services, docs, and assets

The rename commit before this one covered module paths and the obvious
user-facing strings; this is the rest of it -- the places where "sentry"
was a default value, a filename, or a picture rather than a word in a
sentence.

Defaults that changed: CLICKHOUSE_DATABASE (sentry -> cairnobs),
POSTGRES_DATABASE (sentry_metadata -> cairnobs_metadata), and
POSTGRES_USERNAME (sentry -> cairnobs), across api/alerting/ingest and
the enterprise binaries, plus the compose files and migrate scripts that
create those objects. These are *defaults*, so a deployment that sets
them explicitly is unaffected -- but any deployment relying on the old
defaults must have its environment updated before it picks this up, or
it will come up pointing at a database that doesn't exist.

Also: the light-mode logo variants (the dark ones existed alone, so the
landing page and sidebar rendered a dark mark on a light background),
regenerated favicons, and the docs/README/threat-model prose that still
said Sentry.

docs/query-language-design.md

@@ -23,8 +23,15 @@ new cross-backend join strategy from scratch.
 Pipe syntax, SPL-inspired, EBNF-ish:
 
 ```
-query        := base_search ("|" pipe_stage)*
+query        := (base_search | pipe_stage) ("|" pipe_stage)*
 base_search  := bool_expr                      // implicit filter/search, SPL convention
+                                                // omitted entirely when the query starts
+                                                // directly with a pipe-stage keyword (e.g.
+                                                // `stats count by host`, no leading filter,
+                                                // no leading "|") -- means match-everything.
+                                                // A field genuinely named "where"/"stats"/etc
+                                                // still parses as a filter (`where=foo`),
+                                                // disambiguated by comparator lookahead.
 pipe_stage   := "where" bool_expr
               | "stats" agg_call ("," agg_call)* ["by" field ("," field)*]
               | "sort" sort_field ("," sort_field)*