Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/complianceportal/visitor/brand.go

@@ -14,33 +14,15 @@
 
 package visitor
 
-import (
-	"fmt"
-	"net/url"
-)
-
 const (
 	BrandLogoPath     = "/brand/logo"
 	BrandDarkLogoPath = "/brand/dark-logo"
 )
 
 func BrandLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandLogoPath)
+	return portalEndpointURL(portalBaseURL, BrandLogoPath)
 }
 
 func BrandDarkLogoURL(portalBaseURL string) (string, error) {
-	return brandAssetURL(portalBaseURL, BrandDarkLogoPath)
-}
-
-func brandAssetURL(portalBaseURL string, path string) (string, error) {
-	parsed, err := url.Parse(portalBaseURL)
-	if err != nil {
-		return "", fmt.Errorf("cannot parse portal base URL: %w", err)
-	}
-
-	parsed.Path = path
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-
-	return parsed.String(), nil
+	return portalEndpointURL(portalBaseURL, BrandDarkLogoPath)
 }