fix(security): close icons path-prefix bypass, log swallowed exceptions

/icons/image used a bare string startswith() against allowed roots, so
a sibling dir like /usr/share/icons_evil would pass as if it were under
/usr/share/icons. Switched to the pathlib parents-based check already
used correctly in icons/compositor.py, plus a regression test.

Also stopped three bare `except Exception: pass` blocks (auto model
select fallback, conversation titling) from swallowing errors silently
- they now log to the existing chat trace helper. Behavior unchanged,
just visible when something's actually failing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

synapse/main.py

@@ -146,7 +146,8 @@ async def _auto_select_model(message: str = "") -> str:
         if remap:
             return remap
         return await get_ollama_manager().select_best_model(intent)
-    except Exception:
+    except Exception as e:
+        _synapse_trace(f"⚠ auto model selection failed, falling back to default: {e}\n")
         return DEFAULT_CHAT_MODEL
 
 
@@ -198,7 +199,8 @@ async def _generate_conversation_title(first_message: str, model: str) -> Option
         if not title:
             return None
         return title[:120]
-    except Exception:
+    except Exception as e:
+        _synapse_trace(f"⚠ title generation failed: {e}\n")
         return None
 
 
@@ -600,8 +602,8 @@ async def chat_stream_endpoint(payload: Dict[str, Any]):
                         if title:
                             store.set_conversation_title(conversation_id, title)
                             yield f"event: title\ndata: {_json.dumps({'title': title})}\n\n"
-                except Exception:
-                    pass
+                except Exception as e:
+                    _synapse_trace(f"⚠ conversation titling step failed: {e}\n")
 
             # Ask the memory service curator to evaluate this exchange
             if response_chunks:
@@ -1492,10 +1494,14 @@ async def list_icon_apps():
 @app.get("/icons/image")
 async def get_icon_image(path: str):
     """Serve an icon file after verifying it's in an allowed root."""
-    real = _os.path.realpath(path)
-    if not any(real.startswith(r) for r in _ALLOWED_ICON_ROOTS):
+    real = Path(_os.path.realpath(path))
+    allowed = any(
+        real == root or root in real.parents
+        for root in (Path(r).resolve() for r in _ALLOWED_ICON_ROOTS)
+    )
+    if not allowed:
         raise HTTPException(status_code=403, detail="Path not allowed")
-    if not _os.path.isfile(real):
+    if not real.is_file():
         raise HTTPException(status_code=404, detail="Icon not found")
     return FileResponse(real)