docs: logo, security warning, emoji headings

- embed favicon.svg as a logo in the README
- add a prominent "no security — trusted networks only" callout
- sprinkle emoji through README/TODO/PLAN/NOTES headings; fix NOTES typo

README.md

@@ -1,4 +1,6 @@
-# wutzcalc
+# wutzcalc 🍺
+
+<img src="client/public/favicon.svg" alt="wutzcalc logo" width="120" align="right" />
 
 > ## ⚠️ AI-generated code
 >
@@ -8,23 +10,42 @@
 > events), read the code yourself, test the edge cases that matter to you, and
 > assume there are bugs. Use at your own risk.
 
-Festival drink-sale tracker. See [PLAN.md](PLAN.md) for architecture, [NOTES.md](NOTES.md)
+> ## 🔓 No security — trusted networks only
+>
+> **This app has essentially no protection. Assume anyone who can reach it can
+> read and write everything.**
+>
+> - 🚫 The tablet UI (`/`, `/api`) has **no authentication** — anyone on the
+>   network can record sales, return Pfand, or reset a cart.
+> - 🔑 The backoffice (`/admin`) is gated by a **single shared password** in
+>   plaintext (`ADMIN_PASSWORD`), sent and stored as-is — no per-user accounts,
+>   no rate limiting, no audit log.
+> - 🌐 There is **no HTTPS** built in — traffic (including the admin password) is
+>   plaintext unless you put it behind your own TLS-terminating reverse proxy.
+> - 🧱 No CSRF tokens (only a `SameSite=Lax` cookie) and no input hardening
+>   beyond basic request validation.
+>
+> Run it only on a **trusted, isolated LAN** (e.g. the bar's own Wi-Fi/VLAN),
+> never exposed to the public internet. See [TODO.md](TODO.md) for the auth and
+> hardening work deferred from v1.
+
+🎪 Festival drink-sale tracker. See [PLAN.md](PLAN.md) for architecture, [NOTES.md](NOTES.md)
 for the original requirements, and [TODO.md](TODO.md) for deferred work.
 
-Source: <https://git.berlin.ccc.de/vinzenz/wutzcalc>
+🔗 Source: <https://git.berlin.ccc.de/vinzenz/wutzcalc>
 
-## Toolchain setup
+## 🔧 Toolchain setup
 
 Requires Node.js 20+ and pnpm 9+. Native SQLite bindings install from prebuilt
 binaries on x86_64 / arm64 — no compiler needed for most setups.
 
-### Nix (Linux / macOS)
+### ❄️ Nix (Linux / macOS)
 
 ```sh
 nix develop          # node 20, pnpm, sqlite, build deps
 ```
 
-### Debian / Ubuntu
+### 🐧 Debian / Ubuntu
 
 ```sh
 # Node 20 from NodeSource
@@ -36,7 +57,7 @@ sudo corepack enable             # provides pnpm
 sudo apt install -y build-essential python3
 ```
 
-### Fedora
+### 🎩 Fedora
 
 ```sh
 # Node 20 + pnpm (corepack ships with the nodejs package)
@@ -47,7 +68,7 @@ sudo corepack enable             # provides pnpm
 sudo dnf install -y gcc-c++ make python3
 ```
 
-### Windows
+### 🪟 Windows
 
 Install Node.js 20 LTS via the official MSI from <https://nodejs.org> (this
 also installs the optional "Tools for Native Modules"). Then in PowerShell:
@@ -59,7 +80,7 @@ corepack enable                  # provides pnpm
 Use PowerShell to set env vars on the same line, e.g.
 `$env:ADMIN_PASSWORD="changeme"; pnpm dev:server`.
 
-## Dev
+## 🛠️ Dev
 
 ```sh
 pnpm install
@@ -70,7 +91,7 @@ pnpm dev:client                            # http://localhost:5173 (proxies /api
 Open `http://localhost:5173/` for the tablet UI and
 `http://localhost:5173/admin.html` for the backoffice.
 
-## Production build
+## 📦 Production build
 
 ```sh
 pnpm install
@@ -81,7 +102,7 @@ ADMIN_PASSWORD=... DB_PATH=/var/lib/wutzcalc/wutz.db node server/dist/index.js
 Single Node process serves the API, both client entries (`/` tablet,
 `/admin` backoffice), and writes to one SQLite file.
 
-## Run as a systemd service
+## 🚀 Run as a systemd service
 
 On Fedora, the `Makefile` automates everything below — from a fresh checkout, as root:
 
@@ -127,7 +148,7 @@ Confirm `ExecStart` matches your Node path (`command -v node`) — it defaults t
 `/usr/bin/node`. The unit creates `/var/lib/wutzcalc` via `StateDirectory`, so
 the service user owns the database directory automatically.
 
-## Env vars
+## ⚙️ Env vars
 
 - `PORT` (default `3000`)
 - `HOST` (default `0.0.0.0`)