Use the JARL wordmark in the header and as the README banner

The header now shows the login page's wordmark letters (without the rule)
instead of "Jarl" set in Cinzel, so the bundled Cinzel font, its preload
and its licence stanza in the .deb's copyright file are removed: the web
UI needs no web font.

The README opens with the login page's banner, the logo above the
wordmark (artwork/banner.svg). scripts/banner.py builds it from the web
UI's logo.js and brand.js, with light and dark colors, and logo.py runs
it after tracing the logo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -32,7 +32,8 @@ contrib/lego/         program for lego's exec DNS provider
 scripts/e2e.sh        end-to-end test against a real named
 scripts/mkdeb.sh      builds the Debian package (make deb)
 scripts/logo.py       traces artwork/logo.png into the web UI's logo (logo.svg, logo.js)
-artwork/              the logo's master image
+scripts/banner.py     builds the README's banner from the web UI's logo and wordmark
+artwork/              the logo's master image and the README's banner
 ```
 
 The main flow is in `internal/engine/engine.go` (`applyOps`):
@@ -117,16 +118,19 @@ The UI is plain JavaScript modules under `internal/web/static/`, with no
 framework and no build step. The logo's master is `artwork/logo.png` (blue
 `#1d5287` and white on a transparent background). `scripts/logo.py` traces it
 with potrace (needs `potrace` and ImageMagick) into `assets/logo.svg` (the
-favicon and the README's logo) and `assets/logo.js` (the same paths); change
-the PNG and rerun the script rather than editing those files. The header and
+favicon) and `assets/logo.js` (the same paths); change the PNG and rerun the
+script rather than editing those files. The header and
 login page draw the logo inline from `logo.js` (`logo()` in `brand.js`), so
 it appears with the page instead of popping in after a separate download.
 Static files are served with `Cache-Control: no-cache` and a content ETag,
 so a reload revalidates them with cheap 304 answers. The
-login page's "JARL" wordmark is drawn as SVG paths in `assets/brand.js`, so
-it needs no font and takes the theme's text and accent colors. The header's
-"Jarl" uses a Latin subset of Cinzel Bold in `assets/fonts/` (SIL OFL; keep
-`Cinzel-OFL.txt` next to it). All DOM is built with the `h()` helper in
+"JARL" wordmark is drawn as SVG paths by `wordmark()` in `assets/brand.js`
+(over a rule on the login page, the letters alone in the header), so the UI
+needs no web font and the wordmark takes the theme's text and accent colors.
+The README's banner, `artwork/banner.svg`, is the login page's logo and
+wordmark, generated by `scripts/banner.py` from `logo.js` and `brand.js`
+(`logo.py` runs it; run it yourself after editing the wordmark).
+All DOM is built with the `h()` helper in
 `ui.js`, which never uses `innerHTML`, so record data and comments can't
 inject markup. The Content-Security-Policy only allows the app's own
 scripts and styles. To work on it, run jarld and reload the browser: the