Branding and templates: per-domain, tenant and server logos, /logo, operator calendar email templates and RSVP page (BT-1 to BT-26)

Logos resolve domain, then tenant, then server-wide, then the built-in, with
subdomains finding their domain. GET /logo serves a data-URL image, redirects
to a URL logo without fetching it, sandboxes SVG, and answers 404 when no
custom logo applies. Emails embed the first PNG, JPEG or GIF logo. Logo and
template writes are checked; stored templates are read at send time, always
escaped, and fall back to the built-in with a build warning when they don't
parse. The RSVP page is served byte for byte with a CSP and no-referrer. The
sign-in and RSVP pages load the logo through an image element. MT-22's
session logo follows the chain to the server-wide logo.
Acceptance tests 1 to 17; test 18 written as the ignored branding_compat.

crates/http/src/request.rs

@@ -474,14 +474,16 @@ impl ParseHttp for Server {
                     && req.method() == Method::GET
                     && path.next().unwrap_or_default() == "rsvp"
                 {
-
-                    return Ok(HttpResponse::new(StatusCode::OK)
-                        .with_content_type("text/html; charset=utf-8")
-                        .with_header(CONTENT_ENCODING, "gzip")
-                        .with_binary_body(RSVP_PAGE)
-                        .with_no_store());
+                    // inbuxa: BT-20, BT-21
+                    return crate::branding::rsvp_page(self, RSVP_PAGE).await;
                 }
             }
+            // inbuxa: BT-5: the logo that applies, anonymous
+            "logo" if req.method() == Method::GET => {
+                self.is_http_anonymous_request_allowed(session.remote_ip)
+                    .await?;
+                return crate::branding::logo(self, &req).await;
+            }
             "autodiscover" | "Autodiscover" | "AutoDiscover" => {
                 let document_name = path.next().unwrap_or_default();
                 if req.method() == Method::POST