feat: add BrandSettings env-var surface for favicon and email branding

[davidpoblador]

Summary

DaisyUI tokens and CSS variables cover everything that renders inside the page, but a few brand surfaces are out of reach:

• Favicon meta tags (mask-icon, msapplication-TileColor, theme-color) are read by the browser before any CSS runs.
• PWA manifest (theme_color, background_color) is consumed by the OS install UI, also before CSS.
• Magic-link emails render in clients (Gmail, Outlook) that strip <style> blocks and ignore CSS variables.

This PR adds BrandSettings, an app-level pydantic-settings surface that drives those specific surfaces.

Configuration

# All optional; defaults shown.
BRAND_PRIMARY_COLOR=#5b2333
BRAND_BROWSER_THEME_COLOR=#ffffff
BRAND_EMAIL_BUTTON_COLOR=  # falls back to BRAND_PRIMARY_COLOR when unset

• BRAND_PRIMARY_COLOR → Safari pinned-tab mask-icon, Windows tile (browserconfig.xml), magic-link email button (when no override).
• BRAND_BROWSER_THEME_COLOR → mobile browser chrome (<meta name="theme-color">), PWA manifest's theme_color / background_color.
• BRAND_EMAIL_BUTTON_COLOR → override slot for when the email button needs to differ from the primary brand color.

Inputs accept any pydantic-Color form (named, rgb(), hex short or long). Values canonicalise to long-form #rrggbb lowercase via a HexColor subclass that pins __str__ to as_hex(format="long") — bare Color would render #ffffff as the string white, which is awkward to interpolate into HTML attributes.

settings.brand is exposed in every Jinja render via the shipped _brand_context provider, so templates read {{ brand.primary_color }} without wiring anything up. The bundled base/favicons.html.jinja, meta/site.webmanifest.jinja, and meta/browserconfig.xml.jinja already consume it; send_magic_link_email() passes settings.brand.email_button into the email template.

Why app-level, not per-tenant

Favicon assets are static files served before any tenant resolver runs, and the email service does not see request context. For per-tenant in-page colors, keep using TenantTheme.

Drive-by fix

_render_template_with_env now falls back to the bare template name after <lang>/<name> and default/<name>. Framework email templates ship flat at the namespace root (not under default/<lang>/), so without the flat fallback the magic-link email failed to render.

Test plan

• uv run python -m pytest tests/unit — 777 passed
• uv run python -m pytest tests/unit/test_brand_settings.py — 21 new tests cover HexColor subclass, BrandSettings defaults / env-var binding / fallbacks, favicons partial render, webmanifest + browserconfig render, magic-link email render with button color, brand context provider
• just lint-py — passes
• just lint-jinja — passes
• just lint-md — passes
• just type-check — passes

🤖 Generated with Claude Code