feat(isac): add game data icon management

docs/architecture.md

@@ -163,3 +163,18 @@ The unique primary value uses `base × (1 + (level − 1) / 49)` for levels 1–
 talent effects use `base × (1 + upgrades / 5)` for zero to five upgrades.
 Server actions validate all relationships and append the full owned graph to
 the existing `game_data` audit history.
+
+# Game-data icon storage
+
+Talents, brand sets, and OS Protocols reference uploaded artwork through the
+polymorphic `game_data_icons` metadata table. Original uploads are never
+retained. The shared server pipeline accepts transparent SVG, PNG, WebP, and
+AVIF sources, rejects active or externally referenced SVG content, and uses
+Sharp’s asynchronous native worker pool to rasterize and normalize every
+accepted icon to a transparent 256 × 256 WebP.
+
+Normalized files live beneath the ignored `data/game-icons/` directory and are
+served by the validated `/icons/game-data/[type]/[id]` endpoint with immutable
+cache headers and MIME sniffing disabled. ISAC save actions process files
+before mutation, apply upload or removal after record validation, and include
+only safe icon metadata—not image bytes—in their audit snapshots.