Padlock-on-a-shield mark, dark and light themes, history note

A new mark: a padlock on a shield with the W as its keyhole, in the
console's teal on a dark shield. It replaces the placeholder W tile in the
sidebar, on the sign-in and setup pages, and as the favicon, with app icons
and a web manifest. The SVG sources, a single-colour variant, a wordmark
and a social preview image live in docs/brand.

The console now has a theme choice: dark by default, light, or follow the
system, switched from the sidebar or the Account page and remembered per
browser. The light palette is a first-class theme rather than a media
query, so both are laid out the same way.

The README opens with the mark and gains a History section about the 2025
WGX installer this replaces.

README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="docs/brand/wgx-mark-256.png" width="128" height="128" alt="WGX: a padlock on a shield, with a W for a keyhole">
+</p>
+
 # WGX
 
 A WireGuard server with a secure web console, in one container.
@@ -161,6 +165,18 @@ The UI is embedded in the binary. `docker build -t wgx .` does both steps.
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the development loop against the
 mock data plane, which needs no privileges.
 
+## History
+
+This is a complete, ground-up rewrite of an earlier WGX, "WireGuard
+eXtended", which Coffey Labs published in October 2025 and later dropped.
+That one was an installer: a collection of Bash scripts behind a text-mode
+menu that set up and hardened a WireGuard stack on Debian 13 around a
+third-party web UI. The
+[original announcement](https://jcoffey.dev/articles/wg-easy-installer-debian-13/)
+is still up. Nothing from it was carried over; this WGX is its own server and
+its own console, in one container, with the name kept because the intent is
+the same.
+
 ## Licence
 
 AGPL-3.0-or-later. See [LICENSE](LICENSE).