Answer
Store the images in a folder on the application server itself (a genuinely local path, not referenced as a network/UNC path), and make sure the top-level folder containing those images has Read and List permissions granted to Everyone — the login screen is rendered before any user-specific authentication context exists, so the files need to be readable by an unauthenticated/anonymous request, which is why overly restrictive folder permissions (or a UNC path requiring specific credentials) prevents the branding images from loading even when the path itself is technically correct.