7ccfdc1aea
The /favicon.ico route 302-redirected to the uploaded file. Firefox/Chrome follow that, but Safari does NOT reliably follow a redirect for favicon requests — it falls back to the HTML <link>, i.e. the bundled picpeak default. Stream the file bytes directly for local /uploads favicons (with a path-containment guard); only external URLs and the missing-favicon fallback still redirect. sendFile sets the content-type from the extension.