Finish the Cairn OBS rename through services, docs, and assets

The rename commit before this one covered module paths and the obvious
user-facing strings; this is the rest of it -- the places where "sentry"
was a default value, a filename, or a picture rather than a word in a
sentence.

Defaults that changed: CLICKHOUSE_DATABASE (sentry -> cairnobs),
POSTGRES_DATABASE (sentry_metadata -> cairnobs_metadata), and
POSTGRES_USERNAME (sentry -> cairnobs), across api/alerting/ingest and
the enterprise binaries, plus the compose files and migrate scripts that
create those objects. These are *defaults*, so a deployment that sets
them explicitly is unaffected -- but any deployment relying on the old
defaults must have its environment updated before it picks this up, or
it will come up pointing at a database that doesn't exist.

Also: the light-mode logo variants (the dark ones existed alone, so the
landing page and sidebar rendered a dark mark on a light background),
regenerated favicons, and the docs/README/threat-model prose that still
said Sentry.

enterprise/cmd/enterprise-api/Dockerfile

@@ -1,7 +1,7 @@
 # Same shape as every other Go service's Dockerfile in this repo --
 # context must be the repo root (needs both enterprise/ and proto/, like
 # api/Dockerfile does for api/ + proto/), not enterprise/ alone.
-#   docker build -f enterprise/cmd/enterprise-api/Dockerfile -t sentry-enterprise-api .
+#   docker build -f enterprise/cmd/enterprise-api/Dockerfile -t cairnobs-enterprise-api .
 FROM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY . .

enterprise/cmd/enterprise-api/main.go

@@ -17,7 +17,7 @@
 // keeps running plain api/cmd/api, unchanged; a real multi-tenant
 // deployment runs this one instead.
 //
-// Both Helm (deploy/helm/sentry/templates/api.yaml vs
+// Both Helm (deploy/helm/cairnobs/templates/api.yaml vs
 // enterprise-api.yaml) and docker-compose.yml (COMPOSE_PROFILES) now
 // make this the deployment-topology choice, not just a binary sitting
 // unused alongside api's -- see this repo's CLAUDE.md. `search`'s write

enterprise/cmd/enterprise-ingest/Dockerfile

@@ -2,7 +2,7 @@
 # context must be the repo root (needs ingest/, proto/, and enterprise/,
 # like enterprise-api/Dockerfile does for api/ + proto/ + enterprise/),
 # not enterprise/ alone.
-#   docker build -f enterprise/cmd/enterprise-ingest/Dockerfile -t sentry-enterprise-ingest .
+#   docker build -f enterprise/cmd/enterprise-ingest/Dockerfile -t cairnobs-enterprise-ingest .
 FROM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY . .

enterprise/cmd/enterprise-ingest/main.go

@@ -1,6 +1,6 @@
 // Command enterprise-ingest is the multi-tenant-aware alternative to
 // running `ingest -mode=consumer` -- reads the same shared
-// sentry.logs.raw Redpanda topic ingest/cmd/ingest's agent-facing
+// cairnobs.logs.raw Redpanda topic ingest/cmd/ingest's agent-facing
 // server half (PushBatch) produces onto (see that binary's doc
 // comment), but writes each record into its own tenant's dedicated
 // ClickHouse database (enterprise/internal/chwriter) instead of the one
@@ -21,7 +21,7 @@
 // alongside) `ingest -mode=consumer` -- `ingest -mode=server` (the
 // agent-facing half, which tags records with a tenant_id via
 // TenantResolver) keeps running unchanged and unconditionally either
-// way; only which process consumes sentry.logs.raw and where it writes
+// way; only which process consumes cairnobs.logs.raw and where it writes
 // changes.
 package main