v0.4.6: iVentoy-style PXE menu, top-right user menu, Settings touchups

PXE boot menu polish (iVentoy-inspired):
- render_menu now opens with a best-effort `console --picture
  <base>/branding/pxe-logo || console` line so iPXE builds with PNG
  support paint the operator's uploaded raster logo as the background.
- ASCII OpenPXE wordmark banner sits at the top of the menu in
  `item --gap` lines — always visible on every iPXE build, including
  the snponly/undionly variants without graphics console.
- New footer line above `choose`: "OpenPXE v0.4.6 - <arch label>",
  where <arch label> is mapped from iPXE's ${buildarch}/${platform}
  to "x86 BIOS", "x86_64 UEFI", or "arm64 UEFI". No URL, per brief.
- New GET /branding/pxe-logo route serves the operator's PNG / JPEG /
  WebP / GIF as-is for iPXE to consume. SVG uploads 404 here (iPXE
  can't rasterize SVG) — the always-visible ASCII wordmark stands in.
  Route stays public after admin setup so iPXE clients (no cookies)
  can fetch it.

UI:
- Removed the bottom-left "signed in as / Sign out" row.
- Added a person-icon button next to the theme toggle in the topbar.
  Click opens a small popover with: Name (display only), Edit account
  (jumps to Settings), Sign out. Esc + click-outside close it.
- Settings → Account card form chrome made consistent. The previous
  `label.field` selector only styled type=text/number, leaving
  password inputs with default browser chrome. Switched to a
  negation-list selector that covers every typed input we use, plus
  -webkit-appearance:none + a 1px focus ring. Light + dark mode both
  show the same border/padding/focus state across all four account
  fields.
- Settings → SSO card now renders display name, IdP logo URL (new),
  and metadata source on one 3-column row. The metadata <select>
  inherits the same chrome as the text inputs so it baseline-aligns
  with them. SsoConfig grew an idp_logo_url field, persisted to
  sso.json, length-capped and validated to http(s) only.

Quality:
- 138 tests passing (was 132 in v0.4.5). +1 IdP-logo-URL validation,
  +1 PXE menu polish regression guard, +4 /branding/pxe-logo
  integration tests covering missing-config / SVG-fallback / raster-
  serve / post-auth public-allowlist cases.
- cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

crates/webui/src/app.css

@@ -287,16 +287,26 @@ label.field {
 }
 label.field .name { color: var(--fg-dim); font-size: 12px; }
 label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
-label.field input[type="text"],
-label.field input[type="number"],
+/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
+   styled type=text/number, which left type=password fields rendering
+   with the default browser look — visibly off vs adjacent text fields
+   in the Account card. The negation list keeps `type=checkbox`,
+   `type=file`, and `type=range` (none of which we use inside
+   `label.field`) from picking up the padded-box look. */
+label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
 label.field select,
 label.field textarea {
   width: 100%; background: var(--bg); color: var(--fg);
   border: 1px solid var(--border); border-radius: var(--radius);
   padding: 7px 10px; font: inherit;
+  /* iOS/Safari shrinks password-field text by default; clamp it so
+     the password input matches the username input's metrics. */
+  font-size: 14px; line-height: 1.4;
+  box-shadow: none; -webkit-appearance: none; appearance: none;
 }
 label.field input:focus, label.field select:focus, label.field textarea:focus {
   outline: none; border-color: var(--accent);
+  box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
 }
 label.check {
   display: flex; gap: 10px; align-items: center;
@@ -421,9 +431,21 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .dot.err  { background: var(--err); }
 .dot.warn { background: var(--warn); }
 
-/* Inline form rows. */
-.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
-@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
+/* Inline form rows. The default is a 4-column grid sized for the
+   Account card's "Current / New username / New password / Confirm"
+   quartet; the `.cols-3` modifier swaps to a 3-column layout for the
+   SSO header strip (display name / logo URL / metadata source). All
+   `.form-row > label.field` children share the same baseline because
+   their inner inputs share metrics via the global rule above. */
+.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
+.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
+.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
+.form-row label.field { margin-bottom: 0; }
+@media (max-width: 900px) {
+  .form-row,
+  .form-row.cols-3,
+  .form-row.cols-2 { grid-template-columns: 1fr; }
+}
 
 /* ── Queued deployment visual ────────────────────────────────────── */
 .queue-track {
@@ -567,22 +589,56 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 }
 .auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
 
-/* ── Logout chip (sidebar footer) ────────────────────────────── */
-.sidebar .footer .logout-row {
-  margin-top: 8px; display: flex; align-items: center; justify-content: space-between;
-  gap: 8px;
+/* ── Top-right user menu (v0.4.6) ────────────────────────────
+   The "signed in as X" identity + sign-out moved out of the sidebar
+   footer in v0.4.6 — the sidebar footer is now reserved for the
+   service-state trio (Service status / Advertised URL / Backend
+   version). The button matches the theme toggle's size + chrome so
+   the top-right reads as a tidy two-icon strip. */
+.user-menu { position: relative; }
+.user-btn {
+  display: inline-flex; align-items: center; justify-content: center;
+  width: 36px; height: 32px;
+  background: transparent; color: var(--fg);
+  border: 1px solid var(--border); border-radius: 8px;
+  cursor: pointer; padding: 0;
+  transition: background 0.15s ease, border-color 0.15s ease;
 }
-.sidebar .footer .logout-row .who {
-  color: var(--fg); font-weight: 600; font-size: 11.5px;
+.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
+.user-pop {
+  position: absolute; right: 0; top: 38px;
+  min-width: 200px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 6px;
+  z-index: 60;
+  display: flex; flex-direction: column; gap: 2px;
+}
+.user-pop[hidden] { display: none; }
+.user-pop .user-pop-name {
+  padding: 8px 10px 6px;
+  border-bottom: 1px solid var(--border-soft);
+  margin-bottom: 4px;
+  color: var(--fg); font-weight: 600; font-size: 13px;
   overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.sidebar .footer .logout-btn {
-  background: transparent; color: var(--fg-dim);
-  border: 1px solid var(--border); border-radius: var(--radius);
-  padding: 2px 8px; font: inherit; font-size: 11px; font-weight: 500;
+.user-pop .user-pop-item {
+  text-align: left; width: 100%;
+  background: transparent; color: var(--fg);
+  border: 0; border-radius: var(--radius);
+  padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
   cursor: pointer;
 }
-.sidebar .footer .logout-btn:hover { color: var(--fg); background: var(--bg-panel-2); border-color: var(--accent); }
+.user-pop .user-pop-item:hover {
+  background: var(--bg-panel-2); color: var(--fg);
+}
+.user-pop .user-pop-danger { color: var(--err); }
+.user-pop .user-pop-danger:hover {
+  background: color-mix(in srgb, var(--err) 12%, transparent);
+  color: var(--err);
+}
 
 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }