show Dockhand's own mark on its own container

src/lib/components/ContainerIcon.svelte

@@ -4,7 +4,7 @@
 	import { appSettings } from '$lib/stores/settings';
 	import { selfhstMatcher, ensureSelfhstMatcher } from '$lib/stores/selfhst-refs';
 	import { selfhstIcons, requestSelfhst } from '$lib/stores/selfhst-icons';
-	import { isSelfhstIcon, selfhstRef, isCustomIcon, getStackIconComponent } from '$lib/utils/icons';
+	import { isSelfhstIcon, selfhstRef, isCustomIcon, getStackIconComponent, isDockhandImage } from '$lib/utils/icons';
 
 	interface Props {
 		image: string;
@@ -62,6 +62,10 @@
 
 	// An explicit override wins over auto-matching (and the app-logo toggle).
 	const hasOverride = $derived(!!override);
+
+	// Dockhand's own container always shows the app mark (unless the user overrode it),
+	// regardless of the app-logo toggle - it is our own branding, not a selfh.st match.
+	const isSelf = $derived(!hasOverride && isDockhandImage(image));
 	const overrideSelfhst = $derived(selfhstRef(override));
 	const overrideCustom = $derived(isCustomIcon(override));
 	const customIconName = $derived(overrideKey ?? name);
@@ -100,7 +104,9 @@
 	const resolvedSelfhst = $derived(activeSelfhst ? $selfhstIcons[activeSelfhst] : undefined);
 </script>
 
-{#if activeSelfhst && resolvedSelfhst}
+{#if isSelf}
+	<img src="/dockhand-mark.svg" alt="Dockhand" class="{className} object-contain shrink-0" />
+{:else if activeSelfhst && resolvedSelfhst}
 	<img src={resolvedSelfhst} alt="" class="{className} object-contain shrink-0" />
 {:else if activeSelfhst && resolvedSelfhst === undefined}
 	<!-- batch in flight: hold the space so the row doesn't jump -->

src/lib/utils/icons.ts

@@ -56,6 +56,25 @@ export function selfhstRef(icon: string | null | undefined): string | null {
 	return isSelfhstIcon(icon) ? icon!.slice('selfhst:'.length) : null;
 }
 
+/**
+ * Whether an image is Dockhand's own image, so its container shows the app mark.
+ * Matches the `dockhand` repo under the `fnsys`/`finsys` org from any registry,
+ * ignoring the tag/digest (e.g. `fnsys/dockhand:v1.0.47`,
+ * `docker.io/finsys/dockhand`, `registry.bor6.pl/dockhand@sha256:...`).
+ */
+export function isDockhandImage(image: string | null | undefined): boolean {
+	if (!image) return false;
+	const path = image.split('@')[0].split('/'); // drop digest, split path
+	// The tag lives only in the LAST segment (after the last '/'); a registry
+	// host may carry a ':port' earlier, so strip the tag from the last segment only.
+	const name = path[path.length - 1].split(':')[0];
+	if (name !== 'dockhand') return false;
+	const org = path.length >= 2 ? path[path.length - 2] : '';
+	// The official org, or a private-registry host (`registry.example/dockhand`).
+	// A bare or unqualified `<org>/dockhand` is NOT matched - too broad.
+	return org === 'fnsys' || org === 'finsys' || org.includes('.') || org.includes(':');
+}
+
 export { iconMap };
 
 // --- Stack icon set (SEPARATE from env; app/service-oriented) --------------------