feat(tier2): event branding + UX polish — Block D

Backend
- Migration 0010 adds event_branding (one row per event; all fields
  nullable so a brand-new event renders with defaults)
- BrandingRepo with COALESCE/NULLIF upsert semantics: nil pointer
  preserves the existing value, "" clears the field to NULL
- internal/uploads package: ImageStore interface + LocalFSStore (dev),
  pure-stdlib decode + re-encode that strips EXIF and rejects anything
  that isn't valid JPEG/PNG. Size cap 2 MB, random 16-byte filenames
- GET /events/{id}/branding (viewer+) returns the row plus the
  AllowedFonts list so the frontend picker stays in sync
- PUT /events/{id}/branding (editor+) validates hex colours, font
  allowlist, and refuses image URLs whose path doesn't start with
  /uploads/ (blocks arbitrary-origin <img> smuggling on guest pages)
- POST /uploads/image (authed) → fresh CDN URL; GET /uploads/{file}
  serves with year-long cache (immutable random names)
- GET /access/{token} now embeds the host's branding so the RSVP page
  can render in their colours/font with their logo + cover
- docker-compose mounts a named volume for uploads
- Custom-domain sub-block deferred to Tier 3 per the plan

Frontend
- BrandingCard.vue: colour pickers, font dropdown, logo + cover upload
  with progressive disclosure, live preview pane that re-renders on
  every keystroke
- RSVP page applies branding via CSS vars at the section root, so
  primary colour theme + font cascade through every child card. Cover
  image renders as a banner above the form; logo lands in the header
- Submit button background switches to var(--brand-primary) when set
- Mounted on the event detail page below the guests block

Plus the small UX fixes from the e2e walkthrough:
- Nav: dropped the top-level "Events" link; the logo doubles as the
  home affordance (→ /dashboard when signed in, → / otherwise). Account
  + Billing + Sign out live under a profile dropdown (avatar with
  initials, opens on click, closes on outside-click / Esc / route nav)
- Renamed "Back to dashboard" → "Back to events" across event detail,
  billing, account, and new-event pages

Tests
- TestBrandingGetReturnsDefaults / TestBrandingPutPersists /
  TestBrandingPutRejectsBadInputs / TestUploadAndServeImage /
  TestUploadRejectsNonImage — all pass
- Domain tests for IsValidHexColor + IsAllowedFont
- Full integration suite green (176s)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/tokens.go

@@ -35,6 +35,7 @@ type tokenHandler struct {
 	accessLogs    *storage.AccessLogRepo
 	rsvps         *storage.RSVPRepo
 	collabs       *storage.CollaboratorRepo
+	branding      *storage.BrandingRepo
 	gen           *auth.Generator
 	ttl           time.Duration
 	pub           accessPublisher
@@ -416,6 +417,10 @@ type accessResponse struct {
 	// path so the frontend renders four ready-to-click buttons after a
 	// successful RSVP. (Tier 2 Block B.)
 	Calendar calendar.ProviderLinks `json:"calendar"`
+	// Branding lets the RSVP page render in the host's colour scheme /
+	// logo / cover image. Nil when the host hasn't customised yet — the
+	// frontend falls back to defaults. (Tier 2 Block D.)
+	Branding *domain.Branding `json:"branding,omitempty"`
 }
 
 // GET /access/{token} — validate token, log the access attempt, publish to NATS.
@@ -482,6 +487,21 @@ func (h *tokenHandler) access(w http.ResponseWriter, r *http.Request) {
 		OccurredAt:  time.Now().UTC(),
 	})
 
+	var brandingPayload *domain.Branding
+	if h.branding != nil {
+		// Same best-effort treatment as the RSVP lookup below — missing
+		// branding row is the common case, not a failure.
+		br, err := h.branding.Get(r.Context(), event.ID)
+		switch {
+		case err == nil:
+			brandingPayload = br
+		case errors.Is(err, domain.ErrBrandingNotFound):
+			// expected when the host hasn't customised yet
+		default:
+			h.logger.Warn("load branding for access", "err", err, "event_id", event.ID)
+		}
+	}
+
 	var existingRSVP *domain.RSVP
 	if h.rsvps != nil {
 		// Best-effort: a missing RSVP just means the guest hasn't submitted
@@ -505,6 +525,7 @@ func (h *tokenHandler) access(w http.ResponseWriter, r *http.Request) {
 		AccessLog: accessLogID,
 		RSVP:      existingRSVP,
 		Calendar:  h.calendarLinks(event, raw),
+		Branding:  brandingPayload,
 	})
 }