Let the owner change the name, the icon and the dates

Three things that needed a rebuild and a redeploy, or had no way in at all, now
have a Site identity panel in the admin: the restaurant's name and tagline, an
SVG icon upload, and a switch for whether a menu says when it was published.
They live in data/site.json and data/brand/icon.svg, extending ADR 0007: what
the owner changes is content, and the config is the seed plus the theme, which
still needs a rebuild.

An uploaded SVG is a document that would run with this origin's authority, so it
is reduced to shapes on the way in and served with default-src 'none'. The
archive list keeps its dates even when the switch is off, because those dates
are how one old menu is told from another.

Also fixes the live check's own trap: the app caches identity in memory, so the
tests drive it through the app rather than a second store instance, which would
be a second writer.

docs/operating.md

@@ -39,8 +39,14 @@ the order customers see. Two rules: a category's web address is fixed when it is
 created (rename the name as often as you like — a printed QR code keeps working),
 and a category can only be removed once it holds no menus.
 
-**Change brand or theme.** Edit `config/<site>.site.json`, rebuild and push
-(`./deploy.sh <tag>`), then run the playbook with the new tag.
+**Change the restaurant's name or tagline, the icon, or the published dates.** In
+the admin, open the **Site identity** fold: the name and tagline customers see,
+a checkbox for whether a menu says when it was published, and an SVG upload for
+the icon (under 256 KB; the upload replaces the bundled mark and "Remove the
+uploaded icon" brings it back). None of this changes your web addresses.
+
+**Change the colours.** Those are still `config/<site>.site.json`, so they need a
+rebuild and push (`./deploy.sh <tag>`) and the playbook with the new tag.
 
 **Fix a missing image.** If a Page's thumbnail or viewing image is lost while its
 Original survives, the app can rebuild them: