visuals: technology marks, area icons, client wall, two diagrams

Phase 7 (AUD-149), cheapest first.

- internal/brand: vendored Simple Icons path data (CC0) for 50 marks, looked up
  by the technology label the content already uses. Inline SVG, 16 px,
  currentColor, no request and no font. tools/gen_brand_icons.sh regenerates it.
- Six hand-drawn area icons replace the two-letter badges in the nav and on the
  landing cards; the evidence index gets a seventh.
- TechChips renders a mark where one exists and plain text where one does not,
  so a missing icon reads as a decision rather than a broken image.
- Client wall: 45 names as one typeface, one size, one grid of equal tiles, and
  the reason for no logo collage written on the page. No mark invented.
- Two diagrams, authored in-repo: homelab topology (platform-network.md) and
  the RAG pipeline (ai-rag-corpus.md), each referenced from the page it explains.
- Content images now carry intrinsic width/height, loading="lazy" and
  decoding="async" at render time; a site test fails the build if an image
  ships without them.
- Topbar is two rows at desktop: the area names plus marks no longer overlap the
  search form (Lighthouse target-size was failing at 1440 px).
- Favicon, so the browser stops requesting a missing /favicon.ico.

Satisfies: logos on every area page, area icons in nav and cards, two diagrams
referenced from their pages, images sized and lazy, Lighthouse >= 95 held.

(cherry picked from commit a473e4738a3751418c2097df2bcf0568fb6d0208)

tools/gen_brand_icons.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Regenerate internal/brand/icons_gen.go from Simple Icons.
+#
+# Simple Icons (https://simpleicons.org) is CC0 1.0: the icon paths are public
+# domain. The marks themselves remain the trademarks of their owners and are
+# used here only to identify the technology being described.
+#
+# This script runs at development time on a machine with network access. The
+# generated Go file IS committed, so `make build` never needs the network, never
+# needs Node and never needs node_modules. Re-run it only when the icon set
+# changes:
+#
+#   tools/gen_brand_icons.sh
+#
+# Every icon is normalised to a 24x24 viewBox and inlined as path data, so the
+# page carries no image request and the mark takes the chip's text colour.
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+out="$root/internal/brand/icons_gen.go"
+cdn="${SIMPLE_ICONS_CDN:-https://cdn.simpleicons.org}"
+
+# slug:name as published by Simple Icons. Keep this list to marks the content
+# actually uses; an unused icon is dead weight in the binary.
+slugs=(
+  javascript php python homeassistant raspberrypi nixos
+  qdrant prefect n8n mqtt langgraph langchain
+  ffmpeg zigbee threedotjs react proxmox mysql postgresql
+  caddy tailscale neovim htmx go docker borgbackup
+  sqlite spotify rabbitmq openrouter obsidian niri gitea ghostty
+  googlegemini deepseek cplusplus typescript zsh minimax espressif
+  grafana wireguard nginx hashicorp vault linux zig huggingface ollama
+)
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+{
+  echo "// Code generated by tools/gen_brand_icons.sh; DO NOT EDIT."
+  echo "//"
+  echo "// Path data from Simple Icons (CC0 1.0), retrieved from $cdn."
+  echo "// Every mark is a 24x24 viewBox drawn in currentColor."
+  echo
+  echo "package brand"
+  echo
+  echo "// marks maps a Simple Icons slug to its path data."
+  echo "var marks = map[string][]string{"
+} > "$out"
+
+for slug in "${slugs[@]}"; do
+  if ! curl -fsS -m 20 -o "$tmp/$slug.svg" "$cdn/$slug"; then
+    echo "gen_brand_icons: could not fetch $slug" >&2
+    exit 1
+  fi
+  # One or more <path d="..."> elements; monochrome, so the path data is all we keep.
+  mapfile -t paths < <(grep -o 'd="[^"]*"' "$tmp/$slug.svg" | sed 's/^d="//; s/"$//')
+  if [ "${#paths[@]}" -eq 0 ]; then
+    echo "gen_brand_icons: $slug has no path data" >&2
+    exit 1
+  fi
+  printf '\t"%s": {\n' "$slug" >> "$out"
+  for p in "${paths[@]}"; do
+    printf '\t\t`%s`,\n' "$p" >> "$out"
+  done
+  printf '\t},\n' >> "$out"
+done
+
+echo "}" >> "$out"
+
+gofmt -w "$out" 2>/dev/null || true
+echo "gen_brand_icons: wrote $out (${#slugs[@]} marks)"