Fix the logo's pop-in with a traced vector logo

The logo was an 880 KB SVG wrapping a 1254px PNG, downloaded again on
every page load. Keep that PNG as the master (artwork/logo.png) and have
scripts/logo.py trace it with potrace into a 6 KB logo.svg (favicon,
README) and logo.js, which brand.js draws inline in the header and on the
login page so the logo arrives with the page. Remove the unused
logo-white.svg.

Static files now carry content ETags, so reloads get 304s instead of
downloading the UI again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/operations.md

@@ -10,6 +10,9 @@
 | Check the configuration | `jarl check`: full validation plus `named-checkconf -z` |
 | Logs | `journalctl -u jarl` (jarld, including `msg=audit` lines), `journalctl -u named` |
 | Restart / reload TLS | `systemctl restart jarl` / `systemctl reload jarl` |
+| Work on the server itself | `sudo jarl ...`: root uses jarld's local socket and needs no token ([cli.md](cli.md#on-the-server-itself)) |
+| Renew or replace a token | `jarl token rotate NAME --grace 1h` (same grants, new secret; [permissions.md](permissions.md#rotating-a-token)) |
+| Upgrade Jarl | Debian package: build the new one and `sudo apt install ./dist/jarl_*.deb`; otherwise `make && sudo make install && sudo systemctl restart jarl`. jarld upgrades its database when it starts |
 
 Restarting jarld doesn't affect DNS: named keeps serving the files it
 loaded. jarld is only needed to make changes.
@@ -98,12 +101,17 @@ Start named, then apply again.
 
 ## Recovering access
 
+Revoking a token never locks you out: web logins don't depend on tokens,
+and root on the server can always use `sudo jarl` through the local
+socket, without a token.
+
 | Problem | Fix (on the server) |
 |---------|---------------------|
-| Forgot the admin password | `sudo -u jarl jarld user passwd admin` |
+| Revoked or lost the CLI's token | `sudo jarl token create cli --user admin`, or Account → API tokens in the web UI |
+| Forgot the admin password | `sudo jarl user update admin --password`, or (also with jarld stopped) `sudo -u jarl jarld user passwd admin` |
 | Locked out by the login rate limit | wait 15 minutes, or `systemctl restart jarl` (the limiter is in memory) |
 | Lost every admin account | `sudo -u jarl jarld user add --admin rescue` |
-| Need a token without the web UI | `sudo -u jarl jarld user token admin cli` |
+| Need a token without the web UI | `sudo jarl token create cli --user admin`, or `sudo -u jarl jarld user token admin cli` |
 
 ## A secondary server
 
@@ -149,6 +157,8 @@ rndc reconfig
 ## Monitoring
 
 * `GET /healthz` (no authentication) reports that jarld is up.
+* On the server, a check can use the local socket and needs no token:
+  `sudo jarl status -o json`.
 * `GET /api/v1/status` with a read-only token reports named reachability,
   drift and configuration problems. It is suitable for a monitoring check:
   ```sh