- Serve sender logos from theSVG first, falling back to the favicon
  service, with nosniff and a sandboxing CSP on the logo route.
- Add POST /api/logos/sync to scan every non-free-mail sender domain.
- Run the window frameless on Windows and Linux with app-drawn traffic
  lights (close, minimize, maximize over IPC; optional right placement).
  macOS keeps its native traffic lights from the unsigned macOS build.
- Swap lucide-react for iconsax-react.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>