fix: permit branding endpoints without authentication

The login page loads the branding logo before the user is signed in.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/SecurityConfig.java

@@ -89,6 +89,7 @@ public class SecurityConfig {
                         // Public endpoints
                         .requestMatchers(
                                 "/api/v1/health",
+                                "/api/v1/branding/**",
                                 "/api/v1/agents/register",
                                 "/api/v1/agents/*/refresh",
                                 "/api/v1/auth/**",