Fix the logo's pop-in with a traced vector logo

The logo was an 880 KB SVG wrapping a 1254px PNG, downloaded again on
every page load. Keep that PNG as the master (artwork/logo.png) and have
scripts/logo.py trace it with potrace into a 6 KB logo.svg (favicon,
README) and logo.js, which brand.js draws inline in the header and on the
login page so the logo arrives with the page. Remove the unused
logo-white.svg.

Static files now carry content ETags, so reloads get 304s instead of
downloading the UI again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/concepts.md

@@ -263,6 +263,14 @@ of each token is stored, and the full token is shown once.
   what the ready-made `acme` role contains.
 * Administrators can do everything, including managing users and server
   internals. Admin rights are never available through a restricted token.
+* A token can be **rotated**: it gets a new secret but keeps its grants,
+  optionally with a grace period for the old secret.
+
+On the server itself, jarld also listens on a **local unix socket**. There
+the kernel says which system user is connecting, and root and the `jarl`
+user are administrators without a token, so `sudo jarl` needs no setup and
+nobody with root on the server can be locked out. Everyone else needs a
+token there too.
 
 Details: [permissions.md](permissions.md).