Start Housecarl: the logo, the wordmark and the skeleton

Housecarl will be a firewall manager for nftables, built the way Jarl and
Steward are: housecarld (a daemon with a REST API and web UI), hc (the
CLI) and SQLite.

- The logo: a carved Nordic doorway in Jarl's blue (artwork/logo.svg),
  with a small version without the carvings, lighter on dark
  backgrounds. scripts/logo.py builds the web UI's copies and
  scripts/banner.py the README banner.
- The HOUSECARL wordmark in Jarl's and Steward's angular letters, with
  new H, O, U and C (assets/brand.js), and the UI's color tokens.
- housecarld and hc print their version; the Makefile, version package,
  AGENTS.md, CHANGELOG and the design sketch (docs/design.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,41 @@
+<p align="center"><img src="artwork/banner.svg" width="340" alt="Housecarl: a carved Nordic doorway, above the HOUSECARL wordmark"></p>
+
+# Housecarl
+
+*Every Jarl has a housecarl at his side; this one keeps the door.*
+
+Housecarl will be a firewall for Linux that you manage through a web UI, a
+REST API and a command line client (`hc`), all three backed by the same
+API. It is the third of a set with [Jarl](https://gitea.adbraun.lol/adam/jarl),
+the BIND manager, and [Steward](https://gitea.adbraun.lol/adam/steward), the
+DHCP server, and works the same way: every change is checked as a whole
+before it is used, is recorded in a history where it can be undone, and is
+audited.
+
+In Skyrim, a housecarl is the Jarl's sworn bodyguard: it stands at the
+door and decides who comes in. Housecarl does that for your network. It
+keeps the machine's nftables ruleset, built from its own database, in one
+table of its own.
+
+## What it will do
+
+* **Zones** for your interfaces and VLANs (`lan`, `iot`, `guest`, `wan`),
+  with a default policy between each pair, and rules between them.
+* **Address sets** that rules refer to, whose entries can expire by
+  themselves; another program can be allowed to change just one set. That
+  is how Steward's captive portal will let a guest in.
+* **NAT**: masquerading and port forwards.
+* **Changes you can trust**: validated as a whole, checked by nftables
+  before they are applied, applied in one transaction, and undoable. A
+  change that could lock you out is rolled back unless you confirm it.
+
+See [docs/design.md](docs/design.md) for the plan and the open questions.
+
+## Status
+
+Housecarl is at its start: it has its name, its logo and the skeleton of
+the daemon (`housecarld`) and CLI (`hc`). There is nothing to run yet.
+
+## Licence
+
+MIT, see [LICENSE](LICENSE).