feat(tier2): event branding + UX polish — Block D

Backend
- Migration 0010 adds event_branding (one row per event; all fields
  nullable so a brand-new event renders with defaults)
- BrandingRepo with COALESCE/NULLIF upsert semantics: nil pointer
  preserves the existing value, "" clears the field to NULL
- internal/uploads package: ImageStore interface + LocalFSStore (dev),
  pure-stdlib decode + re-encode that strips EXIF and rejects anything
  that isn't valid JPEG/PNG. Size cap 2 MB, random 16-byte filenames
- GET /events/{id}/branding (viewer+) returns the row plus the
  AllowedFonts list so the frontend picker stays in sync
- PUT /events/{id}/branding (editor+) validates hex colours, font
  allowlist, and refuses image URLs whose path doesn't start with
  /uploads/ (blocks arbitrary-origin <img> smuggling on guest pages)
- POST /uploads/image (authed) → fresh CDN URL; GET /uploads/{file}
  serves with year-long cache (immutable random names)
- GET /access/{token} now embeds the host's branding so the RSVP page
  can render in their colours/font with their logo + cover
- docker-compose mounts a named volume for uploads
- Custom-domain sub-block deferred to Tier 3 per the plan

Frontend
- BrandingCard.vue: colour pickers, font dropdown, logo + cover upload
  with progressive disclosure, live preview pane that re-renders on
  every keystroke
- RSVP page applies branding via CSS vars at the section root, so
  primary colour theme + font cascade through every child card. Cover
  image renders as a banner above the form; logo lands in the header
- Submit button background switches to var(--brand-primary) when set
- Mounted on the event detail page below the guests block

Plus the small UX fixes from the e2e walkthrough:
- Nav: dropped the top-level "Events" link; the logo doubles as the
  home affordance (→ /dashboard when signed in, → / otherwise). Account
  + Billing + Sign out live under a profile dropdown (avatar with
  initials, opens on click, closes on outside-click / Esc / route nav)
- Renamed "Back to dashboard" → "Back to events" across event detail,
  billing, account, and new-event pages

Tests
- TestBrandingGetReturnsDefaults / TestBrandingPutPersists /
  TestBrandingPutRejectsBadInputs / TestUploadAndServeImage /
  TestUploadRejectsNonImage — all pass
- Domain tests for IsValidHexColor + IsAllowedFont
- Full integration suite green (176s)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/components/AddToCalendar.vue

@@ -5,14 +5,27 @@
 // Apple Calendar has no web-deeplink — it imports .ics files directly from the
 // device. So Apple and "Other" both point at the .ics download URL; the only
 // difference is the label so a desktop guest knows which to click.
-defineProps<{
+const props = defineProps<{
   links: {
     google: string
     outlook: string
     yahoo: string
     ics: string
   }
+  token: string
 }>()
+
+// The backend embeds a fully-qualified ics URL built from GG_PUBLIC_BASE_URL,
+// which in production points at the same origin as the API (ingress). In
+// dev the public base is the Nuxt frontend (port 3000) — that origin has no
+// /access/.../calendar.ics route, so clicking would 404. We always
+// reconstruct against runtimeConfig.apiBase, which is the host that
+// actually serves the .ics endpoint regardless of deployment topology.
+const config = useRuntimeConfig()
+const icsHref = computed(() => {
+  const base = (config.public.apiBase as string) || ''
+  return `${base}/access/${props.token}/calendar.ics`
+})
 </script>
 
 <template>
@@ -50,7 +63,7 @@ defineProps<{
       <!-- Apple Calendar imports .ics from the file system; pointing at the
            download triggers the OS handler on macOS/iOS. -->
       <a
-        :href="links.ics"
+        :href="icsHref"
         class="flex items-center justify-center gap-1.5 rounded-md border border-zinc-700 bg-zinc-950 px-3 py-2 text-xs font-medium text-zinc-200 transition hover:border-brand-600 hover:bg-brand-500/10 hover:text-brand-200"
       >
         <svg class="h-4 w-4" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
@@ -61,7 +74,7 @@ defineProps<{
 
       <!-- Catch-all .ics for everything that isn't a hosted web calendar. -->
       <a
-        :href="links.ics"
+        :href="icsHref"
         class="flex items-center justify-center gap-1.5 rounded-md border border-zinc-700 bg-zinc-950 px-3 py-2 text-xs font-medium text-zinc-200 transition hover:border-brand-600 hover:bg-brand-500/10 hover:text-brand-200"
       >
         <svg class="h-4 w-4" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">