Mascot: Juniper's bggpipe piper joins the header, favicon, and README

Original art (a bagpiper whose bag is a board game box) lives in
assets/; web-sized derivatives ship in the package: a face-crop avatar
in the header and favicon, and the framed full-length piper on the
review done screen. Served via an allowlisted /static route. README
leads with the full portrait, credited to Juniper.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_webreview.py

@@ -324,3 +324,13 @@ def test_merge_veto_roundtrip(tmp_path):
         json={"title_raw": "Jokin Ha...", "source_photos": "shelf.jpg"},
     )
     assert bad.status_code == 400
+
+
+def test_static_assets_served_with_allowlist(tmp_path):
+    web, _ = make_client(tmp_path)
+    logo = web.get("/static/logo.jpg")
+    assert logo.status_code == 200
+    assert logo.headers["content-type"] == "image/jpeg"
+    assert web.get("/static/favicon.png").status_code == 200
+    assert web.get("/static/nope.js").status_code == 404
+    assert web.get("/static/..%2Ftemplates%2Freview.html").status_code == 404