fix(favorites): route icon img through same-origin proxy, not hotlink

<img src={fav.iconUrl}> hotlinked the external favicon directly; sites
that send Cross-Origin-Resource-Policy: same-origin (e.g. claude.ai)
get blocked by the browser (net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin),
leaving only the letter fallback. Points src at the new same-origin
/api-proxy/favorites/:id/icon route instead (same pattern already used
for the user avatar image). Render guard and onError fallback unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/src/components/dashboard/widgets/favorites-widget.tsx

@@ -360,7 +360,7 @@ function FavoriteTile({
             </span>
             {fav.iconUrl && (
               <img
-                src={fav.iconUrl}
+                src={`/api-proxy/favorites/${encodeURIComponent(fav.id)}/icon`}
                 alt=""
                 width={20}
                 height={20}