feat: bell-tower favicon, lfx-clean flows, branded HTML mail

backend/tests/test_auth.py

@@ -316,3 +316,34 @@ async def test_magic_request_rate_limit(client, session):
         "/api/auth/magic/request", json={"email": MEMBER}
     )
     assert limited.status_code == 429
+
+
+def test_magic_link_mail_has_clickable_branded_html(monkeypatch):
+    from app.auth import mail
+
+    monkeypatch.setattr(settings, "smtp_host", "dummy")
+    message = mail._branded_mail(
+        subject="Dein Login-Link",
+        to_email="a@example.com",
+        headline="Anmeldung bei Kirche Einfach",
+        intro="Klicke auf den Button.",
+        button_label="Jetzt anmelden",
+        button_url="http://localhost:3000/login?token=GEHEIM",
+        note="Gültig 15 Minuten.",
+    )
+    html_part = next(
+        p for p in message.walk() if p.get_content_type() == "text/html"
+    )
+    html = html_part.get_content()
+    # Button = anchor with href around the label; token never in text-only form.
+    assert '<a href="http://localhost:3000/login?token=GEHEIM"' in html
+    assert ">Jetzt anmelden</a>" in html
+    assert mail.BLUE in html  # kirchenblau brand bar
+    assert 'lang="de"' in html
+    # Multipart: plain-text fallback keeps the raw link.
+    parts = [p.get_content_type() for p in message.walk()]
+    assert "text/plain" in parts and "text/html" in parts
+    plain = next(
+        p.get_content() for p in message.walk() if p.get_content_type() == "text/plain"
+    )
+    assert "http://localhost:3000/login?token=GEHEIM" in plain