feat(server): declare public image assets cross-origin

[walker-tx]

AIS-552

Summary

• Declare Cross-Origin-Resource-Policy as a required successful assets.serveImage response header.
• Return the fixed cross-origin value while preserving Access-Control-Allow-Origin: *.
• Regenerate the Goa service, HTTP transport, and OpenAPI artifacts and cover the policy in the existing service test.

Motivation

Uploaded branding is intentionally loaded as a plain image by install and OAuth consent pages, including pages on custom domains. The endpoint needs an explicit policy that permits that supported cross-site use.

Stack

• Depends on feat(dashboard): declare external assets cross-origin #5915
• A separate gram-infra companion PR adds the policy to CDN assets.

Rollout gates

• In dev, confirm an uploaded logo keeps its absolute platform URL, renders on a custom-domain install page, and returns exact cross-origin.
• Confirm OAuth consent branding and a Gram Elements chat turn have no new CORS or CORP regressions.
• Repeat the dashboard-root and sticker checks after production promotion.

Related PR

• CDN companion: https://github.com/speakeasy-api/gram-infra/pull/2966

[linear-code]

AIS-552

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2ce4b64

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

No issues found across 8 files

_{Re-trigger cubic}