feat(tenant): per-theme logos + file-upload + button UI polish

Replace the single tenant avatar with a pair of theme-scoped brand logos.
Render only the theme-matching <img> server-side and swap src on theme
toggle via a JS hook — no reload, no double request, no CSS tricks.

Tenant logos
- TenantLogoService (ImageUploadTrait) with theme whitelist and per-theme
  storage storage/tenants/{uuid}/logo/{light|dark}/, SIZES 128/256/512
- Public serving endpoint auth/tenant-logo-file so login can show the
  logo pre-auth; matching authenticated admin preview endpoint
- appTenantLogoUrl(?size, ?theme) with 4-step fallback cascade; PDF +
  mail always request 'light'
- Admin tenant edit: avatar block replaced by "Tenant logos" details
  block inside the Master-data tab, two side-by-side slots via Pico
  .grid with the core app-file-upload partial
- Policy rename ABILITY_ADMIN_TENANTS_AVATAR_VIEW -> LOGO_VIEW, action
  routes logo / logo-delete / logo-file with theme body/query param
- API endpoint path kept (backward compat), internals on new service
- CLI tenant:logo-migrate-avatars moves legacy avatar/ -> logo/light/
  idempotently (--dry-run, --yes, --cleanup)
- i18n "Tenant image" removed, 12 new keys synced across de/en

File upload component
- Full-width preview + filename/actions below (3D stack layout)
- Fixed 16:9 aspect ratio with 1rem inner padding for consistent
  preview size across any logo aspect
- Transparency checker pattern as background so black logos stay
  visible on dark mode and white logos on light mode
- form="" + deleteFormId support so the partial works with barrier
  forms inside another form

Buttons
- width:100% dropped from button[type="submit"]; scoped back via
  .login-main for the auth-flow primary CTA
- .outline base rule now tints background via color-mix of --app-color
  so secondary/primary/danger outlines all gain a subtle surface
- .outline.secondary restyled Stripe-style in both themes: solid white
  chip with soft shadow in light, solid elevated dark chip with white
  text in dark; neutral border replaces role-colored border
- .app-action-success/.app-action-danger outlines get color-mix bg +
  theme-aware outline-text tokens for stronger contrast
- Filled .primary/.app-action-success/.app-action-danger get raised
  box-shadow (inset highlight + drop) — opt-in via class so chrome
  buttons stay flat
- Dropped the legacy .secondary utility that was clobbering the
  custom-property cascade with a hardcoded muted color

Theme swap
- Logo img carries data-src-light + data-src-dark; theme-toggle JS
  swaps src when data-theme changes, keeping the topbar/login logo in
  sync without a page reload

Quality gates: PHPUnit (2045), PHPStan L5, CS-Fixer, docs link/drift,
codex skills sync — all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Support/helpers/app.php

@@ -407,7 +407,7 @@ function appLayoutNavReservedKeys(): array
         'currentTenant',
         'availableTenants',
         'tenantQueryParam',
-        'tenantAvatar',
+        'tenantLogo',
         'csrfKey',
         'csrfToken',
     ];
@@ -474,9 +474,12 @@ function appBuildLayoutNavContext(array $layoutAuth, array $session, array $quer
         $tenantQueryParam = '?tenant=' . urlencode($tenantUuid);
     }
 
-    $tenantHasAvatar = false;
-    if ($tenantUuid !== '' && class_exists(\MintyPHP\Service\Tenant\TenantAvatarService::class)) {
-        $tenantHasAvatar = app(\MintyPHP\Service\Tenant\TenantAvatarService::class)->hasAvatar($tenantUuid);
+    $tenantHasLogoLight = false;
+    $tenantHasLogoDark = false;
+    if ($tenantUuid !== '' && class_exists(\MintyPHP\Service\Tenant\TenantLogoService::class)) {
+        $logoService = app(\MintyPHP\Service\Tenant\TenantLogoService::class);
+        $tenantHasLogoLight = $logoService->hasLogo($tenantUuid, \MintyPHP\Service\Tenant\TenantLogoService::THEME_LIGHT);
+        $tenantHasLogoDark = $logoService->hasLogo($tenantUuid, \MintyPHP\Service\Tenant\TenantLogoService::THEME_DARK);
     }
 
     $csrfKey = \MintyPHP\Session::$csrfSessionKey;
@@ -498,10 +501,11 @@ function appBuildLayoutNavContext(array $layoutAuth, array $session, array $quer
         'currentTenant' => $currentTenant,
         'availableTenants' => $availableTenants,
         'tenantQueryParam' => $tenantQueryParam,
-        'tenantAvatar' => [
+        'tenantLogo' => [
             'uuid' => $tenantUuid,
             'name' => $tenantName,
-            'hasAvatar' => $tenantHasAvatar,
+            'hasLogoLight' => $tenantHasLogoLight,
+            'hasLogoDark' => $tenantHasLogoDark,
         ],
         'csrfKey' => $csrfKey,
         'csrfToken' => $csrfToken,

core/Support/helpers/branding.php

@@ -150,23 +150,57 @@ function appLogoUrl(?int $size = null): string
 }
 
 /**
- * Resolve logo for auth pages: tenant avatar -> global logo -> default SVG.
+ * Resolve a tenant-scoped logo URL for a given theme with fallback cascade:
+ *   1. Tenant logo for the requested theme
+ *   2. Tenant logo for the other theme (single-theme tenants work on both sides)
+ *   3. Global app logo
+ *   4. Hardcoded brand asset
  *
- * After logout the tenant context (`$_SESSION['current_tenant']`) is preserved,
- * so the login page can show the tenant avatar instead of the generic app logo.
+ * $theme defaults to currentTheme() when omitted, which is the correct choice
+ * for on-page rendering. For contexts without theme (PDF, e-mail) callers
+ * should pass 'light' explicitly via appTenantLogoUrlAbsolute().
  */
-function appAuthLogoUrl(?int $size = null): string
+function appTenantLogoUrl(?int $size = null, ?string $theme = null): string
 {
+    $theme = $theme ?? (function_exists('currentTheme') ? currentTheme() : 'light');
+    $otherTheme = $theme === 'dark' ? 'light' : 'dark';
+
     $tenantUuid = $_SESSION['current_tenant']['uuid'] ?? '';
-    if ($tenantUuid !== '' && class_exists('MintyPHP\\Service\\Tenant\\TenantAvatarService')) {
-        if (app(\MintyPHP\Service\Tenant\TenantAvatarService::class)->hasAvatar($tenantUuid)) {
-            $query = $size ? '&size=' . (int) $size : '';
-            return lurl('auth/tenant-avatar-file?uuid=' . rawurlencode($tenantUuid) . $query);
+    if ($tenantUuid !== '' && class_exists('MintyPHP\\Service\\Tenant\\TenantLogoService')) {
+        $service = app(\MintyPHP\Service\Tenant\TenantLogoService::class);
+        foreach ([$theme, $otherTheme] as $candidate) {
+            if ($service->hasLogo($tenantUuid, $candidate)) {
+                $query = '?uuid=' . rawurlencode($tenantUuid) . '&theme=' . rawurlencode($candidate);
+                if ($size) {
+                    $query .= '&size=' . (int) $size;
+                }
+                return lurl('auth/tenant-logo-file' . $query);
+            }
         }
     }
     return appLogoUrl($size);
 }
 
+/**
+ * Absolute tenant-logo URL for flows without theme context (PDF, e-mail).
+ * Defaults to the light variant — the single-theme convention for those flows.
+ */
+function appTenantLogoUrlAbsolute(int $size = 256, string $theme = 'light'): string
+{
+    return appUrl(appTenantLogoUrl($size, $theme));
+}
+
+/**
+ * Resolve logo for auth pages: tenant logo (theme-aware) -> global logo -> default.
+ *
+ * After logout the tenant context (`$_SESSION['current_tenant']`) is preserved,
+ * so the login page can show the tenant logo instead of the generic app logo.
+ */
+function appAuthLogoUrl(?int $size = null): string
+{
+    return appTenantLogoUrl($size);
+}
+
 /**
  * Absolute logo URL (used in e-mails and metadata).
  */