Get a programme's capture-page branding logo

Requires an API client bearer token.

Returns the per-programme capture-page branding logo as a binary image body (`image/png` or `image/svg+xml`, matching whatever was uploaded via `POST /v1/kyc/branding`). Accepts an optional `flow_key` selector (default `'default'`), matching `GET /v1/kyc/branding`; an unknown key 400s `unknown_flow`, while an archived flow still serves. Requires membership of the programme: the selector's 400-vs-200 split is programme knowledge, not a tenant-wide read, so a caller pinned to another programme in the tenant 403s. 404 when the programme has no logo set for the resolved flow. Every response carries `x-content-type-options: nosniff` and a locked-down `content-security-policy` — this endpoint is a valid direct-navigation target (an `<img src>`), and a hostile upload must never be sniffed or executed.