refactor: extract shared utilities in asset build, LXC script and portal JS

[devin-ai-integration]

Summary

Pure refactor of the three code files in the repo; no behavior change. Generated asset output is verified byte-identical (sha256sum over all 184 generated PNG/ICO/SVG files, before vs. after).

scripts/brandkit.py (new) — shared rendering layer for the asset pipeline. build-assets.py had the per-brand loop and the webOwie/Proxmox block duplicating the same mkdir(parents=True,exist_ok=True) + contain(...).save(...) idiom (~14 call sites) and re-rendering the same two webOwie SVGs a second time. brandkit now owns the primitives (render_svg is lru_cached, so the second webOwie render is free), the deliverable size tables (FAVICON_SIZES, APP_ICONS, BANNER_SIZES, SOCIAL_SIZES), the color/width constants, and the set-level helpers:

favicon_set(icon, dir)   # favicon.ico + favicon-{n}x{n}.png ladder
app_icon_set(icon, dir)  # apple-touch / android-chrome / pwa-maskable
banner_set(logo, cfg, dir, sizes, label)
save_contain(img, out, size, padding, bg)  # ensure_dir + contain + save

build-assets.py becomes build_brand() / build_proxmox() / main() over those helpers. Inside banner(), max(28,int(h*.07)) / max(14,int(h*.035)) were recomputed 3×/2× per banner — now brand_size / tagline_size locals.

scripts/create-netbootxyz-alpine-lxc.sh — replaced the repeated literal prefixes with helpers: step N "..." (was echo "[N/8] ...", hardcoded step total in 8 places), warn, kv for the aligned summary block, alpine_templates for the twice-repeated pveam available --section system, and container_ip for the pct exec … ip -4 addr show eth0 … one-liner. In the embedded installer, the duplicated curl -fL --retry 5 --connect-timeout 20 invocations collapse into fetch <file>, echo "[container] …" into log, and the nginx autoindex/add_header pair that was copied into both location blocks moves up to the server block (location / then becomes empty and is dropped — the server-level root already serves it).

brand.js — the raw-content base URL was hardcoded three times (manifest URL, initial manifest state, rawAsset fallback); now one RAW_BASE (plus REPO_BASE). Added byId / on(selector,type,fn) for the repeated getElementById and querySelectorAll(...).forEach(el=>el.addEventListener(...)) pattern, and assetRow / assetNotice so the empty-state and error-state markup no longer duplicate the .asset-row wrapper. fallbackMark(brand) → markFallback(label) (it only ever used .name).

Link to Devin session: https://app.devin.ai/sessions/844676b8009d4dc3a1d4f40ff90a5810
Requested by: @puchadave

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring