R7+ orchestrator + CC3 logo home: combined patches

Orchestrator-side:
- routers/img_proxy_router.py: 4xx/5xx → 1x1 transparent PNG (eliminates cascade <img onerror>)
- static/sport2.html: removed standalone three.min.js (3d-force-graph bundles), bumped to 1.73.4

CC3 (before limit hit):
- Logo home link applied to ALL HTML pages (admin.html, admin_users.html, audit.html, crm.html, erp.html, kpi.html, login.html)
- Backups in _backups/*.cc3_pre_logo.$ts

CC4 R3 (before plan mode):
- _backups/r3_cc4/ocr.py.pre_S2.$ts

Audit screenshots (80 pages) committed to _audit/audit_20260505_023639/shots/

routers/img_proxy_router.py

@@ -42,7 +42,15 @@ def proxy_image(u: str):
     try:
         r = requests.get(u, timeout=10, headers={"User-Agent": "RiNET-Civic/1.0"})
         if r.status_code != 200:
-            raise HTTPException(r.status_code, f"Origin returned {r.status_code}")
+            # Graceful fallback: return 1x1 transparent PNG (avoids cascading <img onerror> noise)
+            import base64
+            TRANS_PNG = base64.b64decode("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkAAIAAAoAAv/lxKUAAAAASUVORK5CYII=")
+            return Response(content=TRANS_PNG, media_type="image/png", headers={
+                "Access-Control-Allow-Origin": "*",
+                "Cache-Control": "public, max-age=3600",
+                "X-Proxy-Cache": "ORIGIN_4XX",
+                "X-Origin-Status": str(r.status_code),
+            })
         ct = r.headers.get('content-type', 'image/jpeg')
         # Save to cache
         with open(cf, 'wb') as f: f.write(r.content)
@@ -53,4 +61,12 @@ def proxy_image(u: str):
             "X-Proxy-Cache": "MISS"
         })
     except requests.RequestException as e:
-        raise HTTPException(502, f"Origin fetch failed: {e}")
+        # Network error: return 1x1 transparent PNG instead of 502
+        import base64
+        TRANS_PNG = base64.b64decode("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkAAIAAAoAAv/lxKUAAAAASUVORK5CYII=")
+        return Response(content=TRANS_PNG, media_type="image/png", headers={
+            "Access-Control-Allow-Origin": "*",
+            "Cache-Control": "public, max-age=300",
+            "X-Proxy-Cache": "ORIGIN_NET_ERROR",
+            "X-Origin-Error": str(e)[:100],
+        })