v0.9.38: favicon service, docs improvements - #9500

- Imported documents took their token total from the embedding tokenizer's
  per-chunk counts, which estimate differently from the chunker that produced
  the source total, so totals read about 15% high. The prepared index now
  carries the manifest's total, matching the source document.
- Bound manifest token and character counts to the integer columns they are
  written to, so an out-of-range bundle is refused before any work instead of
  failing each document at its final write.
- Log "indexing with bundled vectors" instead of "generating embeddings" when
  a document's vectors come from the bundle.

…tifacts (#9496)

* improvement(docs): inspect workflows on canvas and retire migration artifacts

* improvement(docs): simplify expanded workflows to an interactive canvas

* fix(docs): remove unused preview block export

* chore(docs): drop retired export from unused baseline

…retry timeout-derived icons, no miss flash (#9497)

* improvement(favicons): resolve platform tenants no provider can see, and retry icons chosen after a timeout

A tenant on a platform whose domain has no icon at either provider, even at the
parent (AWS sign-in portals, Coupa, GitLab Dedicated, Databricks apps, Salesforce,
Okta preview, UKG, Jama), and a self-hosted gitlab./jira./testrail. host, now end
their candidate walk at the platform's own site, after their own host and parents
so a tenant's custom icon still wins. A parent's icon reached only because a more
specific lookup timed out is cached for a day instead of thirty, since the host's
own icon may exist.

* improvement(favicons): correct the platform table from vendor docs and keep misses from flashing

GitLab Dedicated instances live on gitlab-dedicated.com (and .systems pre-production);
.site is their Pages domain, kept to match gitlab.io. Adds coupacloud.com, databricks.us,
databricksapps.us, and testrail.io, each a suffix both providers miss at every level;
drops entries the parent walk already resolves and the self-hosted sentry label, whose
name collides with other products. A host with no icon is remembered client-side for the
route's miss lifetime, so a remounted icon shows its fallback without an empty frame, and
the cache key moves to v3 so stale misses for newly mapped platforms clear on deploy.

* fix(favicons): keep provisional icons provisional through reuse, walk past cached parent misses, skip hosting suffixes

A cached hit now records whether it was definite or provisional, so a host reusing a
parent's timeout-derived icon inherits the one-day lifetime instead of a month. A cached
miss at a parent skips only the candidates that parent's own walk covered, so a product
fallback derived from the original host is still tried. The self-hosted product label
no longer applies on a Public Suffix List private (hosting) suffix. Adds the Databricks
military suffix the repo already recognizes, and the client remembers a failed icon only
as long as the route retries an outage.

* chore(favicons): import resolver test mocks from their own files