feat(tenant): per-theme logos + file-upload + button UI polish

Replace the single tenant avatar with a pair of theme-scoped brand logos.
Render only the theme-matching <img> server-side and swap src on theme
toggle via a JS hook — no reload, no double request, no CSS tricks.

Tenant logos
- TenantLogoService (ImageUploadTrait) with theme whitelist and per-theme
  storage storage/tenants/{uuid}/logo/{light|dark}/, SIZES 128/256/512
- Public serving endpoint auth/tenant-logo-file so login can show the
  logo pre-auth; matching authenticated admin preview endpoint
- appTenantLogoUrl(?size, ?theme) with 4-step fallback cascade; PDF +
  mail always request 'light'
- Admin tenant edit: avatar block replaced by "Tenant logos" details
  block inside the Master-data tab, two side-by-side slots via Pico
  .grid with the core app-file-upload partial
- Policy rename ABILITY_ADMIN_TENANTS_AVATAR_VIEW -> LOGO_VIEW, action
  routes logo / logo-delete / logo-file with theme body/query param
- API endpoint path kept (backward compat), internals on new service
- CLI tenant:logo-migrate-avatars moves legacy avatar/ -> logo/light/
  idempotently (--dry-run, --yes, --cleanup)
- i18n "Tenant image" removed, 12 new keys synced across de/en

File upload component
- Full-width preview + filename/actions below (3D stack layout)
- Fixed 16:9 aspect ratio with 1rem inner padding for consistent
  preview size across any logo aspect
- Transparency checker pattern as background so black logos stay
  visible on dark mode and white logos on light mode
- form="" + deleteFormId support so the partial works with barrier
  forms inside another form

Buttons
- width:100% dropped from button[type="submit"]; scoped back via
  .login-main for the auth-flow primary CTA
- .outline base rule now tints background via color-mix of --app-color
  so secondary/primary/danger outlines all gain a subtle surface
- .outline.secondary restyled Stripe-style in both themes: solid white
  chip with soft shadow in light, solid elevated dark chip with white
  text in dark; neutral border replaces role-colored border
- .app-action-success/.app-action-danger outlines get color-mix bg +
  theme-aware outline-text tokens for stronger contrast
- Filled .primary/.app-action-success/.app-action-danger get raised
  box-shadow (inset highlight + drop) — opt-in via class so chrome
  buttons stay flat
- Dropped the legacy .secondary utility that was clobbering the
  custom-property cascade with a hardcoded muted color

Theme swap
- Logo img carries data-src-light + data-src-dark; theme-toggle JS
  swaps src when data-theme changes, keeping the topbar/login logo in
  sync without a page reload

Quality gates: PHPUnit (2045), PHPStan L5, CS-Fixer, docs link/drift,
codex skills sync — all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/css/layout/app-shell.css

@@ -975,7 +975,7 @@
 
   :is(button, [type="submit"], [type="button"], [role="button"]).outline,
   [type="reset"].outline {
-    --app-background-color: transparent;
+    --app-background-color: color-mix(in srgb, var(--app-color) 8%, transparent);
     --app-color: var(--app-primary);
     --app-border-color: var(--app-primary);
   }
@@ -992,7 +992,7 @@
       :active,
       :focus
     ) {
-    --app-background-color: transparent;
+    --app-background-color: color-mix(in srgb, var(--app-color) 18%, transparent);
     --app-color: var(--app-primary-hover);
     --app-border-color: var(--app-primary-hover);
   }
@@ -1029,6 +1029,37 @@
     --app-border-color: var(--app-secondary-hover);
   }
 
+  /* Stripe-style neutral chip — solid elevated surface, high-contrast text,
+     subtle neutral border, medium font-weight. Theme-aware via tokens:
+     in light mode a white chip with soft shadow, in dark mode a lifted
+     dark-gray chip with white text. */
+  :is(button, [type="submit"], [type="button"], [role="button"]).outline.secondary,
+  [type="reset"].outline {
+    --app-background-color: var(--app-button-neutral-bg);
+    --app-color: var(--app-button-neutral-color);
+    --app-border-color: var(--app-button-neutral-border);
+    box-shadow: var(--app-button-neutral-shadow);
+    font-weight: var(--font-medium);
+  }
+
+  :is(button, [type="submit"], [type="button"], [role="button"]).outline.secondary:is(
+      [aria-current]:not([aria-current="false"]),
+      :hover,
+      :active,
+      :focus
+    ),
+  [type="reset"].outline:is(
+      [aria-current]:not([aria-current="false"]),
+      :hover,
+      :active,
+      :focus
+    ) {
+    --app-background-color: var(--app-button-neutral-bg-hover);
+    --app-color: var(--app-button-neutral-color-hover);
+    --app-border-color: var(--app-button-neutral-border-hover);
+    box-shadow: var(--app-button-neutral-shadow-hover);
+  }
+
   :is(
       button,
       [type="submit"],
@@ -1371,7 +1402,6 @@
     content: " *";
   }
 
-  button[type="submit"],
   input:not([type="checkbox"], [type="radio"]),
   select,
   textarea {
@@ -2982,20 +3012,6 @@
     text-align: center;
   }
 
-  .primary {
-    box-shadow: rgba(0, 0, 0, 0.1) 0px 1px 2px;
-  }
-
-  .secondary {
-    border: 1px solid var(--app-border);
-    color: var(--app-muted-color);
-    box-shadow: rgba(0, 0, 0, 0.1) 0px 1px 2px;
-  }
-  .secondary:hover {
-    border: 1px solid var(--app-contrast);
-    color: var(--app-contrast);
-  }
-
   /* Loading state - global cursor and interaction blocking */
   body.is-loading {
     cursor: wait;