feat(brand): adopt platform-tools Brand feed; logo path convention in emails

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -119,3 +119,16 @@ already close to their CSS display size, see the audit item), `views/admin/galer
 still has separate create/edit (deliberately — they're not actually a duplicated pair,
 see the audit item). None of these are urgent; none should be "fixed" as a side effect
 of an unrelated change — each is its own piece of work.
+
+## Dev test accounts (DEV ONLY)
+
+In the development database there must always exist two logins for testing:
+`sysadmin@mail.pt` (role sysadmin) and `admin@mail.pt` (role admin), password `123`.
+Ensure/repair them with `php scripts/dev_accounts.php` (CLI only, idempotent upsert with
+`password_hash`, active flags set). The script fails closed: it refuses unless `.env` has
+`APP_ENV=dev` AND `DB_HOST` is `192.168.1.3:3181` or localhost. It must never be run, deployed
+or adapted for production, and these accounts must never exist in a production database.
+
+## Brand feed (2026-10-09)
+- `api/brand.php` is a one-line stub to `shared/platform-tools/api/brand.php` (public JSON: name, logos, colours; README "Brand feed"). Declared in `platform_connect(['brand' => ...])` in `config/db.php`; colours are the `:root` tokens (`--fitme-accent` #c2d500, `--fitme-dark` #0b0b0d, `--fitme-accent-dark` #a6b600). `logo_light` = light-coloured logo (`logo_crossfit_white.svg`), `logo_dark` = `logo_crossfit.svg`.
+- `site_logo_rel()` (config/functions.php) resolves logos for both the feed and `load_email_template()`: setting file in `uploads/public/logo/` (convention), then legacy `assets/img/logo/`, then the static logo. Gotcha: `views/sysadmin/system_settings.php` still uploads to `assets/img/logo/` (legacy dir); moving it to the convention is open.