Harden server security, rework landing page and refresh branding

Security:
- rooms: rate-limit /invite-email (SMTP spam relay), validate share
  target user exists, guard timingSafeEqual against length mismatch
  in the presentation route (500 -> 403)
- analytics: verify callback token before parsing the 5mb body so
  unauthenticated callers cannot buffer large payloads
- caldav: rate-limit failed Basic-Auth attempts (token brute force),
  lowercase email lookup, case-insensitive principal check
- auth: fall back to the in-memory rate-limit store when Redis is
  unavailable; previously every rate-limited endpoint (incl. login)
  returned 500 when the Redis connection was down

UI/copy:
- Home: factual hero copy and feature cards (6 instead of 9), fix
  double-rendered feature icon, remove fake stats row and pill badge;
  keep the background gradient and card layout
- i18n: consistent informal tone, drop trailing exclamation marks
  from status toasts, remove emoji from transactional emails
- new favicon (logo.svg), restore theme-based default brand logo

Chore:
- gitignore SQLite WAL/SHM files

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes/analytics.js

@@ -9,22 +9,25 @@ import { getAnalyticsToken } from '../config/bbb.js';
 
 const router = Router();
 
+// Token check runs BEFORE the 5mb body parser so unauthenticated callers
+// cannot make the server buffer large payloads.
+// Constant-time comparison to prevent timing attacks. Reject non-string tokens
+// (e.g. ?token=a&token=b would yield an array and crash Buffer.from).
+function verifyCallbackToken(req, res, next) {
+  const { token } = req.query;
+  const expectedToken = getAnalyticsToken(req.params.uid);
+  if (typeof token !== 'string' || token.length !== expectedToken.length ||
+      !crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expectedToken))) {
+    return res.status(403).json({ error: 'Invalid token' });
+  }
+  next();
+}
+
 // POST /api/analytics/callback/:uid?token=... - BBB Learning Analytics callback (token-secured)
 // Excluded from the global 100kb body limit (see index.js): learning analytics
 // payloads for large meetings can be several MB.
-router.post('/callback/:uid', json({ limit: '5mb' }), async (req, res) => {
+router.post('/callback/:uid', verifyCallbackToken, json({ limit: '5mb' }), async (req, res) => {
   try {
-    const { token } = req.query;
-    const expectedToken = getAnalyticsToken(req.params.uid);
-
-    // Constant-time comparison to prevent timing attacks.
-    // Reject non-string tokens (e.g. ?token=a&token=b would yield an array and
-    // crash Buffer.from).
-    if (typeof token !== 'string' || token.length !== expectedToken.length ||
-        !crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expectedToken))) {
-      return res.status(403).json({ error: 'Invalid token' });
-    }
-
     const db = getDb();
     const room = await db.get('SELECT id, uid, learning_analytics FROM rooms WHERE uid = ?', [req.params.uid]);