docs: logo, security warning, emoji headings

- embed favicon.svg as a logo in the README
- add a prominent "no security — trusted networks only" callout
- sprinkle emoji through README/TODO/PLAN/NOTES headings; fix NOTES typo

PLAN.md

@@ -1,9 +1,9 @@
-# wutzcalc — Implementation Plan
+# 🗺️ wutzcalc — Implementation Plan
 
 Festival drink-sale tracker. 3 bars, ~10k attendees over 1 week, old iPads (iOS 12),
 local network only, central linux server.
 
-## Decisions (locked for v1)
+## 🔒 Decisions (locked for v1)
 
 - **Stack:** Preact + Vite (client), Node + Fastify (server), SQLite (better-sqlite3).
 - **Deployment:** single Node process serves API + static client + opens one `.db` file.
@@ -17,7 +17,7 @@ local network only, central linux server.
 - **Undo:** only before confirming, fully local (edit the current cart). No undo of confirmed transactions in v1.
 - **iOS 12 target:** Vite build with `legacy` plugin → ES2017 + polyfills. No CSS features past Safari 12.
 
-## Architecture
+## 🏗️ Architecture
 
 ```
 ┌──────────────┐    HTTP/JSON     ┌────────────────────────┐
@@ -33,7 +33,7 @@ local network only, central linux server.
 - Single port, single binary-ish (`node server.js`). Systemd unit for autostart.
 - SQLite WAL mode for concurrent reads from dashboard while writes happen.
 
-## Data model (SQLite)
+## 🗄️ Data model (SQLite)
 
 ```
 bars(id, name, pfand_cents)
@@ -56,7 +56,7 @@ settings(key, value)                            -- admin password hash etc.
 - `client_uuid` makes confirm idempotent against double-tap / retry.
 - Returns stored as separate line items with `is_return=1` and negative contribution to total.
 
-## API surface
+## 🔌 API surface
 
 - `GET  /api/config?bar=<id>` → bar + its drinks + pfand value.
 - `GET  /api/bars` → list of bars (for tablet first-run picker).
@@ -69,7 +69,7 @@ settings(key, value)                            -- admin password hash etc.
 
 Server is the source of truth for prices — tablet sends drink IDs + qty only.
 
-## Client (tablet) UX
+## 📱 Client (tablet) UX
 
 - **First run:** pick which bar this tablet is. Stored in `localStorage`.
 - **Main screen:** grid of large buttons, one per drink served at this bar.
@@ -80,7 +80,7 @@ Server is the source of truth for prices — tablet sends drink IDs + qty only.
 - All cart edits are local until confirm — undo = remove from cart.
 - Tap targets ≥ 64px, no hover states, no small text.
 
-## Backoffice (v1)
+## 🏢 Backoffice (v1)
 
 - `/admin` login (single password from env `ADMIN_PASSWORD`).
 - Pages:
@@ -89,7 +89,7 @@ Server is the source of truth for prices — tablet sends drink IDs + qty only.
   3. **Stats**: totals per bar, top drinks, crew freebie count/value.
   4. **Export**: CSV of transactions and transaction_items.
 
-## Repo layout
+## 📁 Repo layout
 
 ```
 wutzcalc/
@@ -119,7 +119,7 @@ wutzcalc/
 
 (Admin can be a second entry in the same Vite build, or server-rendered HTML — leaning toward second Vite entry for consistency.)
 
-## Implementation order
+## 🔢 Implementation order
 
 1. Repo scaffold: pnpm workspaces, Fastify server skeleton, Vite client skeleton, shared types package.
 2. SQLite schema + migrations + seed (3 bars, a few drinks).
@@ -131,7 +131,7 @@ wutzcalc/
 8. Legacy build verification on an iOS 12 Safari (or BrowserStack equivalent).
 9. Systemd unit + README deploy instructions + backup cron note.
 
-## Open risks
+## ⚠️ Open risks
 
 - iOS 12 Safari is the main constraint — need to verify Preact + legacy plugin output actually runs there early (after step 1, before building more).
 - Local network reliability: if the WiFi at the venue is flaky, online-only model bites. Tracked in `TODO.md` (offline-capable client).