facebook: the Meta app is LIVE (R-915 closed); website lockup entry

R-915 closed and moved to CLOSED-ITEMS in the same commit. What it had waited
on was R-813's Terms of Service URL, which did not exist until the closed-test
legal set went live this morning.

Filled in the app's Basic settings and verified they persisted across a full
reload (not from the save toast):
  Privacy policy URL              https://felhom.eu/adatkezeles
  Terms of Service URL            https://felhom.eu/feltetelek
  Data deletion instructions URL  https://felhom.eu/adatkezeles
  Category                        "Vallalkozasok es oldalak"

THE APP ICON WAS NOT REQUIRED. The original row listed it among the Live
blockers; Meta answered "All required app settings are complete" with it still
empty. Recorded so the next session does not go hunting for one -- and it
could not be uploaded from here anyway: the icon control creates its file
input only on click, and clicking opens a native dialog the browser tooling
cannot drive.

Published, and READ BACK FROM A FULL PAGE RELOAD rather than the success
toast, because Meta's toasts have lied on this Page before: the badge reads
Published, the string Unpublished is gone, and the page now offers Unpublish.

Nothing was granted. No permission added, no use case changed; the scopes stay
"Ready for testing", which is all a system user needs for the business's own
Page. Going Live changes WHO CAN SEE what the app posts, not what it may do.

R-917 and R-920 are unblocked by this -- both were waiting on posting starting.
R-813's next action (a) is spent.

Also carries the marketing CHANGELOG entry for the header/footer change pushed
in 625d38645c.

CI for the three commits before this one: #875 SUCCESS (after a re-run -- the
first attempt was R-887's lost-job flake, "Set up job" 11m48s then every step
0s), #876 SUCCESS, #877 SUCCESS.

marketing/CHANGELOG.md

@@ -1,5 +1,45 @@
 # marketing — CHANGELOG
 
+## facebook — the Meta app is LIVE; the Page can post in public (2026-10-09)
+
+R-915 is closed. What it had waited on for a day was R-813's Terms of Service URL, which did not
+exist until the closed-test legal set went live this morning.
+
+- **Filled in the app's Basic settings:** Privacy policy URL `https://felhom.eu/adatkezeles`,
+  Terms of Service URL `https://felhom.eu/feltetelek`, User data deletion → *Data deletion
+  instructions URL* `https://felhom.eu/adatkezeles` (the notice says how: write to `info@felhom.eu`),
+  and Category „Vállalkozások és oldalak" — the app exists to manage the Page.
+- **The app icon was NOT required**, although the original row listed it among the blockers. Meta
+  answered „All required app settings are complete" with the icon still empty. Recorded because the
+  row would otherwise keep sending the next session to upload one. (It cannot be uploaded from here
+  anyway — the icon control creates its file input only on click, and clicking opens a native dialog
+  the browser tooling cannot drive.)
+- **Published, and read back from a full page reload rather than the success toast**, because Meta's
+  toasts have lied on this Page before: the badge reads `Published`, the string `Unpublished` is
+  gone, and the page now offers `Unpublish`.
+- **Nothing was granted.** No permission added, no use case changed; the scopes stay
+  „Ready for testing", which is all a system user needs for the business's own Page. Going Live
+  changes **who can see what the app posts**, not what it may do.
+- **R-917 and R-920 are unblocked** by this: both were waiting for posting to start. The long
+  description (§2) and the four Messenger FAQ answers (§5) can be published as posts whenever the
+  operator wants.
+
+## website — one brand lockup in the header, footer links that look like links (2026-10-09)
+
+- The header showed the name twice: `logo.png` carries its own „felhom.eu" lettering under the mark,
+  and a typed `<span class="logo-text">` repeated it beside the image — which also forced the mark
+  down to 40 px. Now the mark alone (the vector `logo_notext.svg`, 54 px) with the brand's OWN
+  lettering next to it, cropped from `logo.png` into `assets/logo-wordmark.png`.
+- **Why the name is artwork and not text:** that face is „M+ 2c"/„Vremena Grotesk" (R-916), which
+  nothing here has, and the site deliberately loads **no external font** — the privacy notice
+  published the same morning states exactly that, so adding Google Fonts to match a logo would have
+  made a published claim false. The Facebook covers already draw the wordmark from the logo for the
+  same reason. The white/blue split is in the artwork itself.
+- Footer links were unstyled, so the browser painted them default blue and **purple once visited**.
+  They now follow the site's own convention: `--blue-bright`, no underline, underline on hover, with
+  **`:visited` pinned to the same colour** — a legal link that changes colour after one read looks
+  like it stopped working.
+
 ## facebook — Page details: categories added, contact already set, Messenger FAQ refused (2026-10-09)
 
 Second task of the day, after the cover work: the Page's details box, the Messenger FAQ and the link