Branding and templates: per-domain, tenant and server logos, /logo, operator calendar email templates and RSVP page (BT-1 to BT-26)

Logos resolve domain, then tenant, then server-wide, then the built-in, with
subdomains finding their domain. GET /logo serves a data-URL image, redirects
to a URL logo without fetching it, sandboxes SVG, and answers 404 when no
custom logo applies. Emails embed the first PNG, JPEG or GIF logo. Logo and
template writes are checked; stored templates are read at send time, always
escaped, and fall back to the built-in with a build warning when they don't
parse. The RSVP page is served byte for byte with a CSP and no-referrer. The
sign-in and RSVP pages load the logo through an image element. MT-22's
session logo follows the chain to the server-wide logo.
Acceptance tests 1 to 17; test 18 written as the ignored branding_compat.

crates/common/src/config/groupware.rs

@@ -100,6 +100,17 @@ impl GroupwareConfig {
         let dr = bp.setting_infallible::<DataRetention>().await;
         let system = bp.setting_infallible::<SystemSettings>().await;
 
+        // inbuxa: BT-19: a stored template that doesn't parse is reported at
+        // start and on each reload; the built-in is used meanwhile
+        inbuxa_features::branding::templates::warn_unusable::<CalendarTemplateVariable>(
+            "CalendarAlarm.template",
+            alarm.template.as_deref(),
+        );
+        inbuxa_features::branding::templates::warn_unusable::<CalendarTemplateVariable>(
+            "CalendarScheduling.emailTemplate",
+            sched.email_template.as_deref(),
+        );
+
         GroupwareConfig {
             max_request_size: dav.request_max_size as usize,
             dead_property_size: dav.dead_property_max_size.map(|v| v as usize),