feat: signed customization client-side hooks

Companion to the rustdesk-server Customization admin page that
produces signed custom.txt blobs.

- src/common.rs: replaces the hardcoded branding pubkey with a
  build-time RUSTDESK_BRANDING_PUBKEY env (option_env!), falling
  back to the operator's primary pubkey so unattended builds still
  produce a working client. Per-customer keys can be baked in via
  CI without source edits.
- flutter/lib/common.dart: adds getAppIconBytes() (cached, base64
  decoded once) and patches loadLogo / loadIcon to honor the buildin
  app-icon. This covers every existing call-site — desktop home
  page, server page, tabbar, and mobile settings — without touching
  any of them.

OPTION_APP_ICON itself ships in the hbb_common submodule (already
bumped in the previous commit).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/common.rs

@@ -2184,7 +2184,14 @@ pub fn read_custom_client(config: &str) {
         log::error!("Failed to decode custom client config");
         return;
     };
-    const KEY: &str = "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM=";
+    // Bake the branding public key in at build time:
+    //   RUSTDESK_BRANDING_PUBKEY=$(cat branding_ed25519.pub) cargo build --release
+    // Default falls back to the operator's primary branding pubkey so
+    // unattended builds still produce a working client.
+    const KEY: &str = match option_env!("RUSTDESK_BRANDING_PUBKEY") {
+        Some(k) => k,
+        None => "o8oOwMOzG/h3x/mDOeBcxQUBTxEQTQSQ/3gTe+K7RME=",
+    };
     let Some(pk) = get_rs_pk(KEY) else {
         log::error!("Failed to parse public key of custom client");
         return;