Harden 2FA disable and website icon privacy

package.json

@@ -39,6 +39,9 @@
       },
       "ATTACHMENTS_KV": {
         "description": "Optional KV namespace fallback for attachment/send-file storage"
+      },
+      "WEBSITE_ICONS_ENABLED": {
+        "description": "Optional: set to true to proxy website icons via third-party icon services. Defaults to disabled for vault-domain privacy."
       }
     }
   },