Use authenticated brands proxy for update entity pictures

[manuveli]

Summary

HacsRepositoryUpdateEntity.entity_picture returned a hardcoded legacy-CDN URL:

return f"https://brands.home-assistant.io/_/{self.repository.data.domain}/icon.png"

After the brands-proxy API landed in HA 2026.3, the CDN no longer accepts new custom-integration submissions, so Update entities for custom integrations that ship inline brand/ assets show a broken picture.

Change

Return /api/brands/integration/{domain}/icon.png — a relative path served by HA's local brands proxy. For core integrations the proxy fetches the upstream CDN image via stale-while-revalidate; for custom integrations it serves the inline brand/icon.png bundled with the integration.

Snapshots under tests/snapshots/hacs-test-org/ were regenerated via pytest --snapshot-update. The domains.json references in custom_components/hacs/validate/brands.py and its fixtures are intentionally untouched — that validator's fallback still serves a valid back-compat check for custom integrations already present in the brands repo.

Relates to #5171
Relates to #5223

The primary fix for the HACS dashboard icons lives in hacs/frontend; this PR finishes the job for Update entities.

Open question for reviewers

This change assumes the HA frontend's entity-picture rendering pipeline applies addBrandsAuth (from upstream src/util/brands-url.ts) to URLs beginning with /api/brands/, so that the access token gets appended client-side. If that's not the case for the update-card render path, the path will 401 on HA ≥ 2026.3. Please verify — happy to pivot if a different shape of URL is preferred.

Test plan

• scripts/test passes (pytest with refreshed snapshots).
• ruff check passes.
• Against HA ≥ 2026.3 with HACS installed and a custom integration shipping inline brand assets: the HACS Update entity for that integration shows the correct logo; network inspector shows a request to /api/brands/integration/{domain}/icon.png?token=….

🤖 Generated with Claude Code