Fix the logo's pop-in with a traced vector logo

The logo was an 880 KB SVG wrapping a 1254px PNG, downloaded again on
every page load. Keep that PNG as the master (artwork/logo.png) and have
scripts/logo.py trace it with potrace into a 6 KB logo.svg (favicon,
README) and logo.js, which brand.js draws inline in the header and on the
login page so the logo arrives with the page. Remove the unused
logo-white.svg.

Static files now carry content ETags, so reloads get 304s instead of
downloading the UI again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -31,6 +31,8 @@ contrib/acme.sh/      acme.sh DNS API hook
 contrib/lego/         program for lego's exec DNS provider
 scripts/e2e.sh        end-to-end test against a real named
 scripts/mkdeb.sh      builds the Debian package (make deb)
+scripts/logo.py       traces artwork/logo.png into the web UI's logo (logo.svg, logo.js)
+artwork/              the logo's master image
 ```
 
 The main flow is in `internal/engine/engine.go` (`applyOps`):
@@ -112,10 +114,15 @@ to that directory's `cli.yaml` to keep using the CLI against it.
 ### The web UI
 
 The UI is plain JavaScript modules under `internal/web/static/`, with no
-framework and no build step. The logo is `assets/logo.svg` (a white figure on
-a Nordic-blue `#2f5fb3` disc) with an all-white variant
-`assets/logo-white.svg`. Both are generated by `scripts/logo.py` (shapes are
-given for the left half and mirrored); edit the script, not the SVGs. The
+framework and no build step. The logo's master is `artwork/logo.png` (blue
+`#1d5287` and white on a transparent background). `scripts/logo.py` traces it
+with potrace (needs `potrace` and ImageMagick) into `assets/logo.svg` (the
+favicon and the README's logo) and `assets/logo.js` (the same paths); change
+the PNG and rerun the script rather than editing those files. The header and
+login page draw the logo inline from `logo.js` (`logo()` in `brand.js`), so
+it appears with the page instead of popping in after a separate download.
+Static files are served with `Cache-Control: no-cache` and a content ETag,
+so a reload revalidates them with cheap 304 answers. The
 login page's "JARL" wordmark is drawn as SVG paths in `assets/brand.js`, so
 it needs no font and takes the theme's text and accent colors. The header's
 "Jarl" uses a Latin subset of Cinzel Bold in `assets/fonts/` (SIL OFL; keep