Branding and templates: per-domain, tenant and server logos, /logo, operator calendar email templates and RSVP page (BT-1 to BT-26)

Logos resolve domain, then tenant, then server-wide, then the built-in, with
subdomains finding their domain. GET /logo serves a data-URL image, redirects
to a URL logo without fetching it, sandboxes SVG, and answers 404 when no
custom logo applies. Emails embed the first PNG, JPEG or GIF logo. Logo and
template writes are checked; stored templates are read at send time, always
escaped, and fall back to the built-in with a build warning when they don't
parse. The RSVP page is served byte for byte with a CSP and no-referrer. The
sign-in and RSVP pages load the logo through an image element. MT-22's
session logo follows the chain to the server-wide logo.
Acceptance tests 1 to 17; test 18 written as the ignored branding_compat.

crates/jmap/src/registry/set.rs

@@ -572,6 +572,22 @@ impl RegistrySet for Server {
                         }
                     };
 
+                    // inbuxa: BT-3, BT-15, BT-22: logos and templates follow their rules
+                    let before = match &modification {
+                        Modification::Update { object, .. }
+                        | Modification::Create {
+                            object: Some(object),
+                            ..
+                        } => Some(object),
+                        Modification::Create { object: None, .. } => None,
+                    };
+                    if let Err(err) =
+                        inbuxa_features::branding::writes::check(before, &new_object)
+                    {
+                        set.failed(modification, err);
+                        continue 'outer;
+                    }
+
                     // inbuxa: UD-16: a kept account's addresses stay its own
                     if let Some(err) =
                         crate::inbuxa::deleted_account::reserved(self, stored, &new_object).await?