fix(prod): land reviewed chat, shell, and app-frame follow-ups

[hamzamerzic]

Summary

This refreshes the remaining reviewed production-chat fixes onto main after #105 landed:

• make chat-list reads lightweight and new-chat reconciliation monotonic
• keep reload fallback logo-free while serving visible logos as fingerprinted assets
• let external app destinations escape inherited iframe sandbox restrictions
• bump the offline app cache and preserve current CSP and Cache-Control on 304 responses
• update the offline-frame E2E contract to the intentional v4 cache revision

Review provenance

• supersedes focused drawer PR fix(chat): make drawer refresh lightweight and monotonic #107, which completed all checks green before becoming behind main
• supersedes focused logo PR fix(shell): make logo lifecycle cache-safe #106, which completed all checks green before becoming behind main
• supersedes revised sandbox PR fix(apps): make external-link sandbox escape cache-safe #102; its hosted E2E run exposed the stale v3 test constant, and the corrected v4 scenario then passed locally in the isolated Docker harness

Validation

• exact focused offline browser scenario: 2 passed
• aggregate frontend unit suites and production build passed
• full backend regression suite passed
• privacy and public-history pre-push gates passed

The pending-question/steer liveness fix is already merged separately in #105.