feat(tenant): per-theme logos + file-upload + button UI polish

Replace the single tenant avatar with a pair of theme-scoped brand logos.
Render only the theme-matching <img> server-side and swap src on theme
toggle via a JS hook — no reload, no double request, no CSS tricks.

Tenant logos
- TenantLogoService (ImageUploadTrait) with theme whitelist and per-theme
  storage storage/tenants/{uuid}/logo/{light|dark}/, SIZES 128/256/512
- Public serving endpoint auth/tenant-logo-file so login can show the
  logo pre-auth; matching authenticated admin preview endpoint
- appTenantLogoUrl(?size, ?theme) with 4-step fallback cascade; PDF +
  mail always request 'light'
- Admin tenant edit: avatar block replaced by "Tenant logos" details
  block inside the Master-data tab, two side-by-side slots via Pico
  .grid with the core app-file-upload partial
- Policy rename ABILITY_ADMIN_TENANTS_AVATAR_VIEW -> LOGO_VIEW, action
  routes logo / logo-delete / logo-file with theme body/query param
- API endpoint path kept (backward compat), internals on new service
- CLI tenant:logo-migrate-avatars moves legacy avatar/ -> logo/light/
  idempotently (--dry-run, --yes, --cleanup)
- i18n "Tenant image" removed, 12 new keys synced across de/en

File upload component
- Full-width preview + filename/actions below (3D stack layout)
- Fixed 16:9 aspect ratio with 1rem inner padding for consistent
  preview size across any logo aspect
- Transparency checker pattern as background so black logos stay
  visible on dark mode and white logos on light mode
- form="" + deleteFormId support so the partial works with barrier
  forms inside another form

Buttons
- width:100% dropped from button[type="submit"]; scoped back via
  .login-main for the auth-flow primary CTA
- .outline base rule now tints background via color-mix of --app-color
  so secondary/primary/danger outlines all gain a subtle surface
- .outline.secondary restyled Stripe-style in both themes: solid white
  chip with soft shadow in light, solid elevated dark chip with white
  text in dark; neutral border replaces role-colored border
- .app-action-success/.app-action-danger outlines get color-mix bg +
  theme-aware outline-text tokens for stronger contrast
- Filled .primary/.app-action-success/.app-action-danger get raised
  box-shadow (inset highlight + drop) — opt-in via class so chrome
  buttons stay flat
- Dropped the legacy .secondary utility that was clobbering the
  custom-property cascade with a hardcoded muted color

Theme swap
- Logo img carries data-src-light + data-src-dark; theme-toggle JS
  swaps src when data-theme changes, keeping the topbar/login logo in
  sync without a page reload

Quality gates: PHPUnit (2045), PHPStan L5, CS-Fixer, docs link/drift,
codex skills sync — all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Console/Commands/Tenant/MigrateLogoAvatarsCommand.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace MintyPHP\Console\Commands\Tenant;
+
+use MintyPHP\Console\Command;
+
+/**
+ * One-time filesystem migration from the legacy tenant avatar layout to the
+ * new per-theme logo layout.
+ *
+ *   storage/tenants/{uuid}/avatar/  →  storage/tenants/{uuid}/logo/light/
+ *
+ * Idempotent: reruns are a no-op because the source directory no longer
+ * exists (or the target is already populated).
+ */
+final class MigrateLogoAvatarsCommand extends Command
+{
+    public function name(): string
+    {
+        return 'tenant:logo-migrate-avatars';
+    }
+
+    public function description(): string
+    {
+        return 'Migrate legacy tenant avatar folders to the light-logo slot';
+    }
+
+    public function usage(): string
+    {
+        return <<<'USAGE'
+        Usage: php bin/console tenant:logo-migrate-avatars [options]
+
+        Options:
+          --dry-run    List tenants that would be migrated without moving files
+          --yes        Execute the migration (required unless --dry-run)
+          --cleanup    After migration, remove empty legacy avatar folders
+
+        The command scans storage/tenants/ and for every tenant with an
+        avatar/ subfolder moves its contents into logo/light/. Tenants that
+        already have logo/light/ are skipped.
+        USAGE;
+    }
+
+    public function execute(array $args, array $options): int
+    {
+        $dryRun = (bool) ($options['dry-run'] ?? false);
+        $confirm = (bool) ($options['yes'] ?? false);
+        $cleanup = (bool) ($options['cleanup'] ?? false);
+
+        if (!$dryRun && !$confirm) {
+            fwrite(STDERR, "Pass --dry-run to preview or --yes to execute.\n");
+            return 1;
+        }
+
+        $storageBase = $this->projectRoot() . '/storage/tenants';
+        if (!is_dir($storageBase)) {
+            fwrite(STDOUT, "No storage/tenants directory — nothing to migrate.\n");
+            return 0;
+        }
+
+        $entries = scandir($storageBase) ?: [];
+        $migrated = 0;
+        $skipped = 0;
+        $errors = 0;
+
+        foreach ($entries as $entry) {
+            if ($entry === '.' || $entry === '..') {
+                continue;
+            }
+            $tenantDir = $storageBase . '/' . $entry;
+            if (!is_dir($tenantDir)) {
+                continue;
+            }
+            $avatarDir = $tenantDir . '/avatar';
+            $logoLightDir = $tenantDir . '/logo/light';
+
+            if (!is_dir($avatarDir)) {
+                continue;
+            }
+
+            if (is_dir($logoLightDir)) {
+                fwrite(STDOUT, sprintf("skip   %s (logo/light already exists)\n", $entry));
+                $skipped++;
+                continue;
+            }
+
+            if ($dryRun) {
+                fwrite(STDOUT, sprintf("would  %s → logo/light\n", $entry));
+                $migrated++;
+                continue;
+            }
+
+            $logoParent = $tenantDir . '/logo';
+            if (!is_dir($logoParent) && !mkdir($logoParent, 0755, true) && !is_dir($logoParent)) {
+                fwrite(STDERR, sprintf("error  %s (could not create logo/)\n", $entry));
+                $errors++;
+                continue;
+            }
+
+            if (!rename($avatarDir, $logoLightDir)) {
+                fwrite(STDERR, sprintf("error  %s (rename failed)\n", $entry));
+                $errors++;
+                continue;
+            }
+
+            // Variant files are named 'avatar-{size}.{ext}' — rename them to 'logo-{size}.{ext}'.
+            $variants = glob($logoLightDir . '/avatar-*.*') ?: [];
+            foreach ($variants as $variantPath) {
+                $newName = preg_replace('/\/avatar-/', '/logo-', $variantPath, 1);
+                if ($newName && $newName !== $variantPath) {
+                    @rename($variantPath, $newName);
+                }
+            }
+
+            fwrite(STDOUT, sprintf("done   %s\n", $entry));
+            $migrated++;
+
+            if ($cleanup) {
+                // rename moved the directory; nothing to clean up. Listed for clarity.
+            }
+        }
+
+        fwrite(STDOUT, sprintf(
+            "\n%s — migrated=%d skipped=%d errors=%d\n",
+            $dryRun ? 'Dry-run complete' : 'Migration complete',
+            $migrated,
+            $skipped,
+            $errors
+        ));
+
+        return $errors > 0 ? 1 : 0;
+    }
+}