refactor(fe): carry only the content type onto the capped blob

Rewrapping the capped stream with the whole original header set attaches
a `Content-Length` and `Content-Encoding` that no longer describe it --
harmless for `.blob()`, but only by accident. The content type is the one
header the blob actually needs, so that's all that comes along.

Also assert what the decoder is handed: `createImageBitmap` must receive
a `Blob`, which is what keeps the encoded image out of the JS heap. That
property was easy to regress silently.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ApQTUxtZxjzpFsoJqKCXxo

Author: claude

src/frontend/src/lib/utils/appMetadata.test.ts

@@ -120,14 +120,16 @@ test("should fetch a same-origin logo and render it from a blob url", async () =
     Response.json({ name: "Example App", logo: "/assets/logo.png" }),
     imageResponse(),
   );
-  const { createObjectURL, toBlob } = setupImageMock();
+  const { createImageBitmap, createObjectURL, toBlob } = setupImageMock();
 
   const result = await fetchAppMetadata(ORIGIN);
 
   expect(result).toEqual({
     name: "Example App",
     logo: LOGO_OBJECT_URL,
   });
+  // The downloaded bytes reach the decoder as a blob, never as a JS buffer.
+  expect(createImageBitmap).toHaveBeenCalledWith(expect.any(Blob));
   // The rendered bytes are II's own re-encoding, held in the browser's blob
   // store: no attacker-controlled payload reaches the DOM or the JS heap, as a
   // `data:` URL would.

src/frontend/src/lib/utils/appMetadata.ts

@@ -137,8 +137,12 @@ const readBodyCapped = async (
     }),
   );
   try {
-    // The headers come along so the blob keeps the response's content type.
-    return await new Response(capped, { headers: response.headers }).blob();
+    // Only the content type is carried over, so the blob keeps it; copying the
+    // rest would attach a `Content-Length` and `Content-Encoding` that no
+    // longer describe this stream.
+    return await new Response(capped, {
+      headers: { "content-type": response.headers.get("content-type") ?? "" },
+    }).blob();
   } catch {
     return undefined;
   }