Logo in system mail; "don't ask for the 2FA code on this device"

System mail: the password-reset email (and the admin panel's test email) now
opens with the Ultimo logo, centered. It is a PNG rendered from
icons/ultimo-logo.svg and embedded in the message (multipart/related, cid:),
so it shows where remote images are blocked and in clients that do not
render SVG. The PNG is listed in package-data so the Docker image carries it.

Trusted devices: a 2FA sign-in offers "Don't ask for the code on this device
in future". Ticked with a correct code, the browser gets its own HttpOnly
trusted-device cookie (token in Redis, 90 days, renewed on use); later
sign-ins to the same account from that browser need only the password. Other
accounts and browsers are unaffected. The trust is revoked on a password
reset, when 2FA is turned off, and when an admin blocks or deletes the user;
signing out keeps it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/identity/user_admin.py

@@ -21,6 +21,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.accounts.service import delete_account
 from app.config import get_settings
 from app.events import get_event_bus
+from app.identity import trusted_devices
 from app.identity.sessions import destroy_all_sessions
 from app.models import Account, Message, User
 from app.plugins.db import plugin_session
@@ -79,6 +80,7 @@ async def _sign_out_everywhere(user_id: uuid.UUID) -> None:
     """Revoke every session, and tell the user's open tabs so they leave at once
     instead of showing already-loaded mail until their next request."""
     await destroy_all_sessions(user_id)
+    await trusted_devices.revoke_all(user_id)
     await get_event_bus().publish("user.signed_out", {"user_id": str(user_id)})