v0.4.6: iVentoy-style PXE menu, top-right user menu, Settings touchups

PXE boot menu polish (iVentoy-inspired):
- render_menu now opens with a best-effort `console --picture
  <base>/branding/pxe-logo || console` line so iPXE builds with PNG
  support paint the operator's uploaded raster logo as the background.
- ASCII OpenPXE wordmark banner sits at the top of the menu in
  `item --gap` lines — always visible on every iPXE build, including
  the snponly/undionly variants without graphics console.
- New footer line above `choose`: "OpenPXE v0.4.6 - <arch label>",
  where <arch label> is mapped from iPXE's ${buildarch}/${platform}
  to "x86 BIOS", "x86_64 UEFI", or "arm64 UEFI". No URL, per brief.
- New GET /branding/pxe-logo route serves the operator's PNG / JPEG /
  WebP / GIF as-is for iPXE to consume. SVG uploads 404 here (iPXE
  can't rasterize SVG) — the always-visible ASCII wordmark stands in.
  Route stays public after admin setup so iPXE clients (no cookies)
  can fetch it.

UI:
- Removed the bottom-left "signed in as / Sign out" row.
- Added a person-icon button next to the theme toggle in the topbar.
  Click opens a small popover with: Name (display only), Edit account
  (jumps to Settings), Sign out. Esc + click-outside close it.
- Settings → Account card form chrome made consistent. The previous
  `label.field` selector only styled type=text/number, leaving
  password inputs with default browser chrome. Switched to a
  negation-list selector that covers every typed input we use, plus
  -webkit-appearance:none + a 1px focus ring. Light + dark mode both
  show the same border/padding/focus state across all four account
  fields.
- Settings → SSO card now renders display name, IdP logo URL (new),
  and metadata source on one 3-column row. The metadata <select>
  inherits the same chrome as the text inputs so it baseline-aligns
  with them. SsoConfig grew an idp_logo_url field, persisted to
  sso.json, length-capped and validated to http(s) only.

Quality:
- 138 tests passing (was 132 in v0.4.5). +1 IdP-logo-URL validation,
  +1 PXE menu polish regression guard, +4 /branding/pxe-logo
  integration tests covering missing-config / SVG-fallback / raster-
  serve / post-auth public-allowlist cases.
- cargo clippy --workspace --all-targets clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

crates/http-api/tests/full_flow.rs

@@ -1742,3 +1742,92 @@ async fn docs_lists_new_v0_4_5_endpoints() {
         assert!(paths.iter().any(|p| p == needle), "{needle} missing");
     }
 }
+
+// ─── v0.4.6: PXE logo endpoint ────────────────────────────────────────────
+
+#[tokio::test]
+async fn pxe_logo_404_when_no_custom_logo_configured() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("no custom logo"), "got: {text}");
+}
+
+#[tokio::test]
+async fn pxe_logo_404_when_uploaded_logo_is_svg() {
+    // iPXE can't rasterize SVG, so an SVG upload deliberately doesn't
+    // light up the PXE menu's `console --picture` overlay — the ASCII
+    // wordmark in render_menu stands in instead.
+    let (state, _dir) = build_state().await;
+    state
+        .branding
+        .set_logo(
+            "image/svg+xml",
+            "svg",
+            br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
+        )
+        .unwrap();
+    let app = build_router(state);
+    let (s, body) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::NOT_FOUND);
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("SVG"), "got: {text}");
+}
+
+#[tokio::test]
+async fn pxe_logo_serves_raster_with_correct_mime() {
+    let (state, _dir) = build_state().await;
+    state
+        .branding
+        .set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake-png-bytes")
+        .unwrap();
+    let app = build_router(state);
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/branding/pxe-logo")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let ct = res
+        .headers()
+        .get(axum::http::header::CONTENT_TYPE)
+        .unwrap()
+        .to_str()
+        .unwrap();
+    assert_eq!(ct, "image/png");
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    assert!(body.starts_with(b"\x89PNG"), "PNG header missing");
+}
+
+#[tokio::test]
+async fn pxe_logo_endpoint_is_public_after_admin_setup() {
+    // iPXE clients can't send a session cookie, so /branding/pxe-logo
+    // must stay reachable once the admin has been bootstrapped. The
+    // auth allowlist gates `/api/*` only.
+    let (state, _dir) = build_state().await;
+    state
+        .branding
+        .set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake")
+        .unwrap();
+    let app = build_router(state);
+    // Configure an admin so the middleware kicks in.
+    let (s, _, _) = post_collect(
+        &app,
+        "/api/setup",
+        r#"{"username":"admin","password":"hunter2hunter2"}"#,
+    )
+    .await;
+    assert_eq!(s, StatusCode::CREATED);
+    // Still public without a cookie.
+    let (s, _) = get(&app, "/branding/pxe-logo").await;
+    assert_eq!(s, StatusCode::OK);
+}