feat(tenant): per-theme logos + file-upload + button UI polish

Replace the single tenant avatar with a pair of theme-scoped brand logos.
Render only the theme-matching <img> server-side and swap src on theme
toggle via a JS hook — no reload, no double request, no CSS tricks.

Tenant logos
- TenantLogoService (ImageUploadTrait) with theme whitelist and per-theme
  storage storage/tenants/{uuid}/logo/{light|dark}/, SIZES 128/256/512
- Public serving endpoint auth/tenant-logo-file so login can show the
  logo pre-auth; matching authenticated admin preview endpoint
- appTenantLogoUrl(?size, ?theme) with 4-step fallback cascade; PDF +
  mail always request 'light'
- Admin tenant edit: avatar block replaced by "Tenant logos" details
  block inside the Master-data tab, two side-by-side slots via Pico
  .grid with the core app-file-upload partial
- Policy rename ABILITY_ADMIN_TENANTS_AVATAR_VIEW -> LOGO_VIEW, action
  routes logo / logo-delete / logo-file with theme body/query param
- API endpoint path kept (backward compat), internals on new service
- CLI tenant:logo-migrate-avatars moves legacy avatar/ -> logo/light/
  idempotently (--dry-run, --yes, --cleanup)
- i18n "Tenant image" removed, 12 new keys synced across de/en

File upload component
- Full-width preview + filename/actions below (3D stack layout)
- Fixed 16:9 aspect ratio with 1rem inner padding for consistent
  preview size across any logo aspect
- Transparency checker pattern as background so black logos stay
  visible on dark mode and white logos on light mode
- form="" + deleteFormId support so the partial works with barrier
  forms inside another form

Buttons
- width:100% dropped from button[type="submit"]; scoped back via
  .login-main for the auth-flow primary CTA
- .outline base rule now tints background via color-mix of --app-color
  so secondary/primary/danger outlines all gain a subtle surface
- .outline.secondary restyled Stripe-style in both themes: solid white
  chip with soft shadow in light, solid elevated dark chip with white
  text in dark; neutral border replaces role-colored border
- .app-action-success/.app-action-danger outlines get color-mix bg +
  theme-aware outline-text tokens for stronger contrast
- Filled .primary/.app-action-success/.app-action-danger get raised
  box-shadow (inset highlight + drop) — opt-in via class so chrome
  buttons stay flat
- Dropped the legacy .secondary utility that was clobbering the
  custom-property cascade with a hardcoded muted color

Theme swap
- Logo img carries data-src-light + data-src-dark; theme-toggle JS
  swaps src when data-theme changes, keeping the topbar/login logo in
  sync without a page reload

Quality gates: PHPUnit (2045), PHPStan L5, CS-Fixer, docs link/drift,
codex skills sync — all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Service/User/UserAccessPdfService.php

@@ -7,6 +7,7 @@ use Dompdf\Options;
 use Endroid\QrCode\QrCode;
 use Endroid\QrCode\Writer\PngWriter;
 use MintyPHP\Service\Branding\BrandingLogoService;
+use MintyPHP\Service\Tenant\TenantLogoService;
 use Throwable;
 use ZipArchive;
 
@@ -14,7 +15,8 @@ class UserAccessPdfService
 {
     public function __construct(
         private readonly UserAccessTemplateService $userAccessTemplateService,
-        private readonly BrandingLogoService $brandingLogoService
+        private readonly BrandingLogoService $brandingLogoService,
+        private readonly ?TenantLogoService $tenantLogoService = null
     ) {
     }
 
@@ -29,7 +31,8 @@ class UserAccessPdfService
         $locale = (string) ($context['locale'] ?? '');
         $vars = is_array($context['vars'] ?? null) ? $context['vars'] : [];
         $vars['pdf_title'] = self::buildPdfTitle($locale);
-        $vars['app_logo_url'] = $this->resolveLogoDataUri();
+        $tenantUuid = (string) ($user['tenant_uuid'] ?? $user['primary_tenant_uuid'] ?? '');
+        $vars['app_logo_url'] = $this->resolveLogoDataUri($tenantUuid);
         $vars['login_qr_data_uri'] = self::buildLoginQrDataUri((string) ($vars['login_url'] ?? ''));
         $vars['generated_at'] = gmdate('Y-m-d H:i:s') . ' UTC';
 
@@ -152,13 +155,22 @@ class UserAccessPdfService
         return $html;
     }
 
-    private function resolveLogoDataUri(): string
+    private function resolveLogoDataUri(string $tenantUuid = ''): string
     {
         $path = '';
         $mime = '';
 
-        // Prefer tenant/app branding logo first.
-        if ($this->brandingLogoService->hasLogo()) {
+        // Prefer tenant light-logo if available (PDF has no theme context; always-light).
+        if ($this->tenantLogoService !== null && $tenantUuid !== '' && $this->tenantLogoService->hasLogo($tenantUuid, TenantLogoService::THEME_LIGHT)) {
+            $logoPath = $this->tenantLogoService->findLogoPath($tenantUuid, TenantLogoService::THEME_LIGHT, 128);
+            if ($logoPath && is_file($logoPath)) {
+                $path = $logoPath;
+                $mime = $this->tenantLogoService->detectMime($logoPath);
+            }
+        }
+
+        // Fallback to global app-branding logo.
+        if ($path === '' && $this->brandingLogoService->hasLogo()) {
             $logoPath = $this->brandingLogoService->findLogoPath(128);
             if ($logoPath && is_file($logoPath)) {
                 $path = $logoPath;