Logo in system mail; "don't ask for the 2FA code on this device"

System mail: the password-reset email (and the admin panel's test email) now
opens with the Ultimo logo, centered. It is a PNG rendered from
icons/ultimo-logo.svg and embedded in the message (multipart/related, cid:),
so it shows where remote images are blocked and in clients that do not
render SVG. The PNG is listed in package-data so the Docker image carries it.

Trusted devices: a 2FA sign-in offers "Don't ask for the code on this device
in future". Ticked with a correct code, the browser gets its own HttpOnly
trusted-device cookie (token in Redis, 90 days, renewed on use); later
sign-ins to the same account from that browser need only the password. Other
accounts and browsers are unaffected. The trust is revoked on a password
reset, when 2FA is turned off, and when an admin blocks or deletes the user;
signing out keeps it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/pyproject.toml

@@ -53,11 +53,12 @@ where = ["."]
 include = ["app*", "workers*"]
 
 # Non-Python files that a *non-editable* install (the Docker image) must carry:
-# the account presets config (SPEC §6.2) and the shared Alembic env used by the
-# per-plugin migration runner (app/plugins/migrate.py). Without these, a
-# `pip install ./backend` produces a package that fails at runtime.
+# the account presets config (SPEC §6.2), the shared Alembic env used by the
+# per-plugin migration runner (app/plugins/migrate.py) and the logo embedded in
+# system mail (app/identity/mailer.py). Without these, a `pip install ./backend`
+# produces a package that fails at runtime.
 [tool.setuptools.package-data]
-app = ["accounts/presets.yaml", "plugins/alembic/*"]
+app = ["accounts/presets.yaml", "plugins/alembic/*", "identity/assets/*.png"]
 
 [tool.ruff]
 line-length = 100