offscale in the catalogue, and the comments the rename falsified

The plugin half is in gitea.officer.dev/plugins/offscale (95b84ea). This is what
the platform owed it.

- marketplace: offscale now ships assets/icon.png, so the catalogue carries an
  iconUrl and a `bare` tile like music's. The lucide `icon` stays as the fallback
  for a failed asset publish — a glyph beats the generic box.

- Four schema files cited `headscale_servers` as the shape they copied. The table
  is `offscale_servers` as of today, so those sentences named a table that no
  longer exists. Same for secret-store.ts's list of purposes.

The crypto purpose moved with it: `decryptSecret('headscale', …)` in the plugin
is now `'offscale'`, and the secret-store row was renamed rather than abandoned,
so the key material is preserved and the change is reversible. Safe only because
offscale_servers held 0 rows — one stored API key and this would have been a
re-encryption, not a rename.

Verified: offscale_servers, uq_offscale_servers_one_active and
uq_offscale_servers_user_url all exist in Postgres and nothing named headscale
does. Dropped the empty table by hand first, because drizzle-kit push treats a
rename as an interactive prompt and would have hung.

tsgo clean. 808 pass / 7 fail — +21 from offscale's first tests, same 7 failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/plugins/marketplace.ts

@@ -124,6 +124,10 @@ const CATALOGUE: CatalogueEntry[] = [
     label: 'Offscale',
     summary: 'Your tailnet — machines, users, pre-auth keys, access policy and device invites',
     color: '#818cf8',
+    // Ships artwork as of 2026-08-15, so the tile is `bare` like music's. `icon` stays as the fallback
+    // for the case the assets fail to publish — the glyph is strictly better than the generic box.
+    tile: 'bare',
+    iconUrl: 'https://gitea.officer.dev/plugins/offscale/raw/branch/main/assets/icon.png',
     icon: 'Network',
     source: 'https://gitea.officer.dev/plugins/offscale.git',
     permissions: [