v0.167.0: outlined logo + favicon (Part 4 follow-up to v0.166.0)

Viktor pushed the text-outlined logo.svg to felhom.eu main (be9edb4) — wordmark is
now 17 real path glyphs. Swapped FelhomLogoSVG to it; stripped Inkscape's leftover
empty <text/> shells + font-* style leftovers on the paths via lxml DOM pass (glyphs
untouched, no text-to-path by CC), dropped editor namedview. Cleaned FelhomFaviconSVG
vestigial <text>. Both constants now free of <text>/font-family; viewBoxes unchanged;
palette + gradients preserved. TestLogoSVG_NoLiveText committed green.

controller/internal/web/mobile_nav_test.go

@@ -163,9 +163,25 @@ func TestLogin_CustomerNameKept(t *testing.T) {
 	}
 }
 
-// Group E — versioned asset URLs (Scenario E). The logo-constant no-live-text test ships WITH
-// Part 4 (the outlined-asset swap), which is gated on Viktor pushing the outlined master; it is
-// intentionally not part of this suite while the constants still carry live <text>.
+// Group E — logo constants carry NO live text (Scenario E). Under `<img>` secure static mode only
+// locally-installed fonts resolve, so a `font-family` in the SVG renders a fallback font everywhere;
+// the wordmark must be outlined paths. Shipped in v0.167.0 once the outlined master landed on
+// felhom.eu main and the vestigial empty text nodes were stripped.
+//
+// Red-proof (recorded 2026-07-24): run against the pre-v0.167.0 constants → FAILS, both constants
+// contained `<text` + `font-family`.
+func TestLogoSVG_NoLiveText(t *testing.T) {
+	for name, s := range map[string]string{"FelhomLogoSVG": FelhomLogoSVG, "FelhomFaviconSVG": FelhomFaviconSVG} {
+		if strings.Contains(s, "<text") {
+			t.Errorf("%s contains a <text element — the wordmark must be outlined paths, not live text", name)
+		}
+		if strings.Contains(s, "font-family") {
+			t.Errorf("%s contains font-family — it renders in a fallback font under <img> secure static mode", name)
+		}
+	}
+}
+
+// Group E — versioned asset URLs (Scenario E).
 //
 // Red-proof: run against the pre-edit layout.html → both assertions FAIL (the /static/ URLs lack
 // the ?v= cache-bust). Cloudflare edge-caches /static/* for 4h, so an unversioned logo/favicon keeps