Let the owner change the name, the icon and the dates

Three things that needed a rebuild and a redeploy, or had no way in at all, now
have a Site identity panel in the admin: the restaurant's name and tagline, an
SVG icon upload, and a switch for whether a menu says when it was published.
They live in data/site.json and data/brand/icon.svg, extending ADR 0007: what
the owner changes is content, and the config is the seed plus the theme, which
still needs a rebuild.

An uploaded SVG is a document that would run with this origin's authority, so it
is reduced to shapes on the way in and served with default-src 'none'. The
archive list keeps its dates even when the switch is off, because those dates
are how one old menu is told from another.

Also fixes the live check's own trap: the app caches identity in memory, so the
tests drive it through the app rather than a second store instance, which would
be a second writer.

CONTEXT.md

@@ -6,6 +6,10 @@ Publishing the customer-facing menus of several brewery-restaurant Sites. A Site
 
 ### Structure
 
+**Site identity**:
+The restaurant's name, tagline, icon and display switches, as customers see them. Edited in the admin, stored in the Site's data rather than its configuration.
+_Avoid_: brand config, theme
+
 **Site**:
 One restaurant's customer-facing menu deployment, with its own brand, Sections and content. Each Site runs its own instance of the app.
 _Avoid_: brand, tenant, deployment, instance