Finish the Cairn OBS rename through services, docs, and assets

The rename commit before this one covered module paths and the obvious
user-facing strings; this is the rest of it -- the places where "sentry"
was a default value, a filename, or a picture rather than a word in a
sentence.

Defaults that changed: CLICKHOUSE_DATABASE (sentry -> cairnobs),
POSTGRES_DATABASE (sentry_metadata -> cairnobs_metadata), and
POSTGRES_USERNAME (sentry -> cairnobs), across api/alerting/ingest and
the enterprise binaries, plus the compose files and migrate scripts that
create those objects. These are *defaults*, so a deployment that sets
them explicitly is unaffected -- but any deployment relying on the old
defaults must have its environment updated before it picks this up, or
it will come up pointing at a database that doesn't exist.

Also: the light-mode logo variants (the dark ones existed alone, so the
landing page and sidebar rendered a dark mark on a light background),
regenerated favicons, and the docs/README/threat-model prose that still
said Sentry.

enterprise/internal/audit/audit.go

@@ -3,11 +3,11 @@
 // section. Two independent defenses back the "no update/delete path
 // from the application layer" requirement -- both verified against a
 // live Postgres, not just written: audit_writer (this package's own
-// Postgres role, via its own connection pool, never the shared `sentry`
+// Postgres role, via its own connection pool, never the shared `cairnobs`
 // role every other store uses) has only INSERT+SELECT grants, and a
 // BEFORE UPDATE OR DELETE trigger (metadata/migrations/0015-0016)
 // rejects the operation for *any* role, including the table owner --
-// confirmed live: even `sentry` cannot UPDATE a row without first
+// confirmed live: even `cairnobs` cannot UPDATE a row without first
 // disabling the trigger, a privileged operation distinct from ordinary
 // application access.
 //

enterprise/internal/audit/integration_test.go

@@ -34,7 +34,7 @@ func testPool(t *testing.T, user, password string) *pgxpool.Pool {
 	if addr == "" {
 		t.Skip("AUDIT_TEST_POSTGRES_ADDR not set -- skipping live-Postgres integration test")
 	}
-	dsn := fmt.Sprintf("postgres://%s:%s@%s/sentry_metadata", user, password, addr)
+	dsn := fmt.Sprintf("postgres://%s:%s@%s/cairnobs_metadata", user, password, addr)
 	pool, err := pgxpool.New(context.Background(), dsn)
 	if err != nil {
 		t.Fatalf("opening pool: %v", err)
@@ -65,7 +65,7 @@ func cleanupAuditLog(t *testing.T, adminPool *pgxpool.Pool) {
 
 func TestAppendAndVerifyChainRealPostgres(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -104,7 +104,7 @@ func TestAppendAndVerifyChainRealPostgres(t *testing.T) {
 // field on QueryAuditEntry -- matching that type's own doc comment.
 func TestQueryAPILoggerWritesAttributedToContextIdentity(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -131,7 +131,7 @@ func TestQueryAPILoggerWritesAttributedToContextIdentity(t *testing.T) {
 
 func TestQueryAPILoggerRefusesWithoutIdentity(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -149,7 +149,7 @@ func TestQueryAPILoggerRefusesWithoutIdentity(t *testing.T) {
 // confidence/accepted/edited fields that don't have dedicated columns.
 func TestAIInteractionLoggerWritesAttributedToContextIdentity(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -199,7 +199,7 @@ func TestAIInteractionLoggerWritesAttributedToContextIdentity(t *testing.T) {
 
 func TestAIInteractionLoggerRefusesWithoutIdentity(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -216,7 +216,7 @@ func TestAIInteractionLoggerRefusesWithoutIdentity(t *testing.T) {
 // would also pass.
 func TestVerifyChainDetectsTampering(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -270,7 +270,7 @@ func TestVerifyChainDetectsTampering(t *testing.T) {
 // unit test of the Go code alone.
 func TestAppendConcurrentWritesProduceAValidChain(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)
 
@@ -316,7 +316,7 @@ func TestAppendConcurrentWritesProduceAValidChain(t *testing.T) {
 // the previous checkpoint's hash.
 func TestCheckpointerRun(t *testing.T) {
 	writerPool := testPool(t, "audit_writer", os.Getenv("AUDIT_TEST_POSTGRES_PASSWORD"))
-	adminPool := testPool(t, "sentry", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
+	adminPool := testPool(t, "cairnobs", os.Getenv("AUDIT_TEST_ADMIN_PASSWORD"))
 	cleanupAuditLog(t, adminPool)
 	defer cleanupAuditLog(t, adminPool)