feat(brand): BRAND_* env scheme — instance branding without a rebuild

Replace baked-in UOM/MysticMoon/UOMysticmoon branding with a BRAND_* env
scheme so one prebuilt image runs as any shard; UOMysticmoon becomes the
first tenant that sets these vars rather than a special case in the code.

Architecture (chosen because the app ships as a prebuilt image):
- server/src/config/brand.js + bot/src/brand.js read BRAND_* once at boot,
  with Runic Gateway defaults.
- Text/colors reach the SPA at RUNTIME through the existing public settings
  API (settings.model.getPublic -> SiteContext), so no client rebuild. The
  admin-editable site title + contact email still override BRAND_NAME/email.
- SiteContext applies BRAND_ACCENT_COLOR to the --accent CSS var at runtime.
- Express templates the built index.html <title>/description/OG/favicon at
  serve time from BRAND_* (renderIndexHtml in app.js).
- Server-side consumers read brand directly: emails, TOTP issuer, API docs,
  boot logs, HTML error page. Bot uses it for embed color + logs.

Assets: logo/hero/favicon delivered from a ./brand:/app/brand bind-mount
(BRAND_LOGO/HERO/FAVICON), with neutral defaults baked in; hero falls back
to a built-in image when unset.

Scope: also genericized package.json names (uomysticmoon-* -> runic-gateway-*)
and the DB_NAME/DB_USER/COOKIE_NAME code defaults (runic_gateway/runic/
rg_token). Production keeps its real values by pinning them in .env — see
.env.uomysticmoon.example, which reproduces the exact UOMysticmoon identity
(proof the substitution works). Changing a deployed COOKIE_NAME invalidates
existing sessions, so UOMysticmoon pins uomm_token.

Verified: 193 server tests pass, client builds, app.js loads + templates the
built index.html, brand transform injects title/description/OG/favicon.

server/src/config/brand.js

@@ -0,0 +1,46 @@
+// ── Branding (BRAND_*) ─────────────────────────────────────────────────────
+//
+// Single source of instance branding. Reads BRAND_* env vars once at startup,
+// with Runic Gateway defaults, so any instance substitutes its own identity
+// without a rebuild (the app ships as one prebuilt image).
+//
+// How it reaches the UI:
+//   • Text + colors + asset paths are surfaced to the SPA through the public
+//     settings API (settings.model.getPublic → SiteContext). The two fields the
+//     admin can edit (site title, contact email) override these defaults.
+//   • The static index.html shell (title/description/OG/favicon) is templated by
+//     Express at serve time (see src/app.js).
+//   • Server-side consumers (emails, TOTP issuer, API docs) read this directly.
+//
+// Image assets are delivered from the /brand mount (BRAND_LOGO/HERO/FAVICON), or
+// any absolute URL. Runic Gateway ships neutral defaults baked into the image so
+// an instance with no BRAND_* set still renders.
+require('dotenv').config()
+
+const name = process.env.BRAND_NAME || 'Runic Gateway'
+
+const brand = {
+  name,
+  shortName: process.env.BRAND_SHORT_NAME || name,
+  tagline: process.env.BRAND_TAGLINE || 'an independent private Ultima Online shard',
+  description:
+    process.env.BRAND_DESCRIPTION ||
+    `${name} — an independent private Ultima Online shard. News, screenshots, guides, and community notes.`,
+  contactEmail: process.env.BRAND_CONTACT_EMAIL || process.env.CONTACT_TO || '',
+  url: process.env.BRAND_URL || '',
+  // Visual
+  accent: process.env.BRAND_ACCENT_COLOR || '#7f99bd',
+  logo: process.env.BRAND_LOGO || '', // empty → no logo image rendered
+  hero: process.env.BRAND_HERO || '/assets/img/hero-moon.png',
+  favicon: process.env.BRAND_FAVICON || '', // empty → no favicon link injected
+}
+
+// Discord embeds want an int (0xRRGGBB). Parse the accent hex once; fall back to
+// the default accent if it's malformed.
+brand.accentInt = (() => {
+  const hex = String(brand.accent).replace('#', '')
+  const n = parseInt(hex, 16)
+  return Number.isNaN(n) ? 0x7f99bd : n
+})()
+
+module.exports = brand