feat(org): dynamic open graph images for school sites (#709)

* feat(org): add dynamic open graph images for school sites

Generate branded 1200x630 OG images for org public sites via GET /org/og/:siteName.png.
Paying cloud orgs include their landing-page tagline; free plans show a Powered by
ClassroomIO watermark. Dashboard org-site meta tags now point at the dynamic image.

Co-authored-by: Rotimi Best <[email protected]>

* feat(org): enable custom favicon upload and org-site rendering

Allow org admins to upload a favicon from domain settings, persist it via
PUT /organization, and render it on public org sites with logo fallback.

Co-authored-by: Rotimi Best <[email protected]>

* fix(org): scope custom favicon to public org-site routes only

Co-authored-by: Rotimi Best <[email protected]>

* refactor(api): inline org-site OG rendering, remove @cio/og-images package

Move template and render helpers into apps/api/src/utils/org-site-og.ts.
Certificates stay in a shared package because they support multiple templates;
org OG is a single API-only concern.

Co-authored-by: Rotimi Best <[email protected]>

* chore: remove packages/og-images directory

Co-authored-by: Rotimi Best <[email protected]>

* refactor(api): mount org OG image under /org-site/og

Align with existing org-site public routes (/org-site/course) instead of a
top-level /org prefix.

Co-authored-by: Rotimi Best <[email protected]>

* refactor(plans): consolidate isOrgOnFreePlan into options-based utility

Move orgId guard and self-hosted/plan checks into @cio/utils/plans.
Dashboard and API callers pass plans, isSelfHosted, and optional orgId
directly; remove the dashboard store wrapper.

Co-authored-by: Rotimi Best <[email protected]>

* fix(org): require orgId for free-plan check and translate favicon strings

Treat missing orgId as not on free plan so nav gating matches prior
behavior when currentOrg is unset. Pass organization.id from OG service.

Add favicon settings translations for all non-English locales.

Co-authored-by: Rotimi Best <[email protected]>

* refactor(dashboard): move meta tag helpers to metaTags.server.ts

Keep PRIVATE_SERVER_URL resolution in a server-only module so dynamic
private env imports cannot leak into universal or client bundles.

Co-authored-by: Rotimi Best <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Rotimi Best <[email protected]>

packages/utils/src/plans/index.ts

@@ -1,6 +1,7 @@
 export * from './constants';
 export * from './automation';
 export * from './public-api';
+export * from './org-plan';
 export * from './utils';
 export * from './token-packs';
 

packages/utils/src/plans/org-plan.ts

@@ -0,0 +1,26 @@
+import { PLAN } from './constants';
+
+export type OrgPlanLike = {
+  planName: string | null;
+  isActive: boolean | null;
+};
+
+export type IsOrgOnFreePlanOptions = {
+  plans?: OrgPlanLike[] | null;
+  isSelfHosted: boolean;
+  orgId?: string | null;
+};
+
+export function isOrgOnFreePlan({ plans, isSelfHosted, orgId }: IsOrgOnFreePlanOptions): boolean {
+  if (!orgId) {
+    return false;
+  }
+
+  if (isSelfHosted) {
+    return false;
+  }
+
+  const activePlan = plans?.find((plan) => plan.isActive);
+
+  return !activePlan || activePlan.planName === PLAN.BASIC;
+}

packages/utils/src/validation/organization/organization.ts

@@ -96,6 +96,7 @@ export const ZUpdateOrganization = z.object({
     })
     .optional(),
   avatarUrl: z.url().optional(),
+  favicon: z.union([z.url(), z.null()]).optional(),
   theme: z.string().optional(),
   landingpage: z.record(z.string(), z.unknown()).optional(),
   siteName: z.string().min(1).optional(),