G2.3: Windy Git branding — and get it out of one host's disk into the repo

The front end was 100% stock Gitea: green teacup, "Gitea: Git with a cup of
tea", "A painless, self-hosted Git service". G2.3 was specified in the plan with
an acceptance test and never executed, and nothing enforced it.

Now: Windy Git name, wind-mark logo, brand-blue accent, and a landing page that
says what this actually is. Uses Gitea's SUPPORTED surface (custom templates +
public assets) so upstream upgrades keep arriving — no source modified (D-2/I-1).

Two traps this cost, both now documented and tested:

1. GITEA__DEFAULT__APP_NAME does not work. Gitea reads APP_NAME from the TOP
   LEVEL of app.ini; the env var created a literal [default] section that Gitea
   ignores, so the installer's stock APP_NAME kept winning while the config
   looked correct. The env-to-ini pass also APPENDED a second APP_NAME rather
   than replacing the first — a new variant of the documented G4A.3 trap.

2. Cloudflare caches /assets/* for 6h and no token in this stack can purge, so
   the new logo and CSS were invisible while being correct at origin. Brand
   assets now carry a VERSION IN THE FILENAME; bump it on every change.

Committed with an idempotent apply.sh, because applying it straight to Veron's
disk first was itself the config-drift trap this project documents: a rebuild
would have silently reverted to stock Gitea.

85 tests green.

Co-Authored-By: Claude (Fable 5) <noreply@anthropic.com>

api/tests/test_invariants.py

@@ -703,3 +703,28 @@ def test_i12_build_fails_when_commit_sha_is_empty():
     and it happened on 2026-08-14."""
     df = (ROOT / "Dockerfile").read_text()
     assert 'test -n "${COMMIT_SHA}"' in df
+
+
+# --------------------------------------------------------------------------
+# G2.3 — branding lives in the repo, not only on one host's disk
+# --------------------------------------------------------------------------
+def test_g23_branding_is_version_controlled():
+    """It was applied directly to Veron's disk first, which is the config-drift
+    trap this project documents: the running system and the repo disagree, and
+    a rebuild silently reverts to stock Gitea."""
+    b = ROOT / "deploy" / "branding"
+    for f in ("apply.sh", "README.md", "templates/home.tmpl",
+              "templates/custom/header.tmpl"):
+        assert (b / f).exists(), f"missing {f}"
+
+
+def test_g23_brand_css_filename_is_versioned():
+    """Cloudflare caches /assets/* for 6h and no token here can purge, so a
+    fixed filename leaves stale bytes live for hours."""
+    import re as _re
+
+    hdr = (ROOT / "deploy" / "branding" / "templates" / "custom" / "header.tmpl").read_text()
+    m = _re.search(r"theme-windy\.v(\d+)\.css", hdr)
+    assert m, "brand CSS must carry a version in its FILENAME"
+    assert (ROOT / "deploy" / "branding" / "public" / "assets" / "css"
+            / f"theme-windy.v{m.group(1)}.css").exists()