fix: read the default Honcho URL at runtime and release dashboard v1.2.3

[outpoints]

Summary

The published image ignored HONCHO_BASE_URL at runtime. next build inlines process.env.NEXT_PUBLIC_* into server code as well as browser code, so the proxy fell back to http://localhost:8000 and every new browser was seeded with it. A phone opening the dashboard over Tailscale or a new LAN address showed HTTP 502: Upstream fetch failed until the instance was set by hand under CONFIG.

• Resolve the default Honcho target from runtime env (HONCHO_PROXY_BASE_URL, then runtime NEXT_PUBLIC_HONCHO_BASE_URL, then the build-time value) for the proxy fallback.
• Render the root layout per request and pass the default to the browser in a meta tag, so new browsers and the NEW_INSTANCE form start on the configured Honcho.
• Move an untouched default/local seed that still holds the build-time URL to the runtime default. Edited instances are never changed.
• Keep every previously allowed proxy target allowed.
• Render the Honcho logo and favicon without an SVG filter, which Safari rasterized at low resolution on iPhone.
• Bump the dashboard to 1.2.3.

Compatibility

Compared against the published 1.2.2 image across five env setups (template with HONCHO_BASE_URL unset or set, HONCHO_PROXY_BASE_URL only, allowlist only, no env). Every proxy response matched 1.2.2 except the configured-default case that used to return 502, which now returns 200.

Test plan

• npm run check (58 tests, including 13 new ones in scripts/default-target.test.mjs)
• Image built without build args, run with the compose template: fresh browser, legacy seed, renamed instance and multi-instance cases pass over LAN and Tailscale (Playwright, iPhone viewport)
• Verified on a real iPhone over LAN and Tailscale
• Logo compared in WebKit and Chromium at 20, 24 and 64 px