feat: self-hosted favicon resolver via /favicon/<domain>

Adds a Kafka-hosted favicon proxy at /favicon/<domain>:
- Fetches favicon.ico from the target domain
- In-memory cache with 1-hour TTL and ETag support (304 Not Modified)
- Max 64KB per favicon to prevent memory abuse
- Privacy: user browser talks to Kafka, not Google/DuckDuckGo

New "Self (Kafka)" option in the favicon service selector.
Defaults to None. No third-party requests when self is chosen.

internal/views/templates/preferences.html

@@ -78,6 +78,7 @@
           <option value="none" selected>None</option>
           <option value="google">Google</option>
           <option value="duckduckgo">DuckDuckGo</option>
+          <option value="self">Self (Kafka)</option>
         </select>
       </div>
     </section>