cpatpa rebrands Mike as Pip and ships firm-customisable branding

Page title, OG metadata, twitter card, error-page title, support
form copy, models page copy, workflows "system" badge, tabular and
workflow column-prompt placeholders, project people modal docblock,
and the site logo wordmark all swap "Mike" for "PIP".

metadataBase and the site-logo landing href now read
NEXT_PUBLIC_API_BASE_URL instead of hard-coding the upstream
mikeoss.com domain.

Internal type names (MikeProject, MikeChat, etc.), the
mikeApi.ts module and the MikeIcon component intentionally stay -
those are part of a follow-up rename so the diffs stay reviewable.

Bulk rename of upstream-shaped identifiers so the codebase reads as
PIP end-to-end:

  MikeProject, MikeChat, MikeChatDetailOut, MikeCitationAnnotation,
  MikeDocument, MikeDocumentVersion, MikeEditAnnotation, MikeFolder,
  MikeMessage, MikeWorkflow, MikeIcon, MikeLayout -> Pip*
  mikeApi.ts -> pipApi.ts, mike-icon.tsx -> pip-icon.tsx
  application/mike-doc, application/mike-folder DnD MIME-likes -> pip-*
  mike:close-row-actions event -> pip:close-row-actions

Removes the long-dead `mike` boolean prop on PipIcon and its three
callsites.

Backend defaults: chatTools system prompt is now PIP-branded and AU
English-tuned (AGLC4 citations, metric, DD/MM/YYYY, no fabrication,
not-legal-advice reminder). Org admins can still override via
/admin/org-settings. Tracked-change author and change-id prefix flip
from "Mike" to "PIP" so docx revisions surface the right name.

- Rename package.json + lockfile names (mike -> pip, mike-backend
  -> pip-backend) in both apps.
- Update shared/types.ts header comment.
- Migrate localStorage key mike.selectedModel -> pip.selectedModel
  with a one-time legacy read so existing users keep their model
  selection.
- Replace mikeoss.com placeholder URL on the support page with a
  neutral example.com value.

Adds an admin-managed branding surface so the firm's brand colours
and logos can be set from the UI without touching code.

Schema (migration 0021):
- org_settings.brand_primary_hex   default #A93226 (brand red)
- org_settings.brand_secondary_hex default #36475C (dark navy)
- org_settings.brand_neutral_hex   default #6E6E6E (nav text grey)
- org_settings.logo_*_path columns for five variants:
  full_colour, full_white, mark, dark_mono, favicon

Logos live as plain files under ${DATA_ROOT}/branding (mounted to
/data/branding in the backend container). Filenames are
content-hashed so cache busting is automatic. PNG, SVG, WebP, JPEG
accepted for normal variants; .ico, PNG, or SVG for the favicon.
2 MB cap.

Backend:
- New lib/branding.ts (load, write, read, delete, mime/hex
  validation).
- New /branding (public) endpoint pair: GET /branding returns the
  colour tokens + logo URLs; GET /branding/logo/:filename streams
  bytes. No auth required since logos are non-sensitive and the
  login splash needs them.
- New /admin/branding endpoints: GET, PATCH (colours),
  POST /admin/branding/logo/:variant (multipart upload),
  DELETE /admin/branding/logo/:variant.
- singleFileUpload helper now takes a maxBytes argument so the
  branding route can cap at 2 MB without affecting document upload
  limits.

Frontend:
- New BrandingProvider context loads /branding once on app boot,
  injects CSS variables (--pip-primary, --pip-secondary,
  --pip-neutral), and swaps <link rel="icon"> when a favicon
  variant is uploaded.
- SiteLogo prefers the uploaded full_colour variant, falls back to
  the built-in PipIcon + wordmark.
- AppSidebar header shows the mark variant when uploaded; otherwise
  the wordmark renders in the brand-red colour.
- New /admin/branding page: hex colour pickers, drag/upload zones
  per logo variant with preview and remove buttons.

Infra:
- docker-compose mounts ${DATA_ROOT}/branding to /data/branding,
  sets BRANDING_LOCAL_PATH.
- install.sh provisions the branding dir at uid 10001.
- Caddy template adds /branding /branding/* to @backend_api.