Drop the inline <style> from the shipped logo (4.0.1)

[robireton]

Fixes #19.

login.html uses {% include %} to put logo.svg inline, so the SVG's <style> block ended up on the sign-in page of daedalus, email_service and monitor. One inline style there rules out a Content-Security-Policy without 'unsafe-inline' in style-src, for all three apps.

Changes

• logo.svg: deleted <defs><style>.text, .graphic {stroke-width: 0;}</style></defs>. It did nothing: the logo has no stroke, and nothing on the page gives it one (login.css is the page's only stylesheet). Also fixed <svg mlns=…> to xmlns=. The typo is harmless when inlined, but the file isn't valid on its own.
• New test: test_login_page_has_no_inline_style_or_script renders the sign-in page and fails on any <style>, style=, on*=, or <script> without src. The chi-platform audit catches the same thing, but only when someone runs it; this test runs on every change.
• 4.0.1: __version__, the README install snippets, an "Upgrading from 4.0.0 to 4.0.1" note, and a "Templates" rule in CLAUDE.md.

Verification

• The new test failed before the fix with ['<style'] != [], and passes after. The full suite passes: 110 tests. ruff check and ruff format --check are clean.
• I rendered the logo before and after at 192 dpi with ImageMagick: 0 differing pixels. I also viewed the render to confirm it's the logo and not two blank images.
• chi-platform/audit.sh user_manager: ✓ 18 checks.

After merging

Tag v4.0.1. Each app then needs its pin bumped to pick up the fix; until all three are bumped, package-pin-consistent will flag the ones still behind.

🤖 Generated with Claude Code