When the thumbnail fails, AvatarURL and OrganisationLogoURL answered
"/" + the blob key, which skips storage.uploads.public_path_prefix and
public_url (a 404 with the WinterCMS layout). They now answer the
original's attach.File.URL.
- Organisation gains the public attachOne logo (OrganisationLogoField),
editable as an image upload on the Organisations form; avatar unchanged
- OrganisationLogoURL and OrganisationLogoFields give applications the
has_logo, logo and logo_url keys for their organisation payloads
- no migration: attachments live in system_files
