Tazel takes A.B.C, then .D, .E and -METADATA if needed, so the descriptor
check follows it.

Accept plugin versions of four numbers

Progmasoft's releases move to four numbers, and the plugins publish here.

Serve the Progmasoft mark as the site icon

The sites declared no icon and /favicon.ico answered 404, so search
engines and assistants that show a site's icon (DuckDuckGo, ChatGPT)
fell back to a gray placeholder; the only copy of the mark was the BIMI
logo for mail.

The app now has the Next.js icon files, so every page links them:

- app/icon.svg: the four squares of the BIMI logo, cropped to the mark
  so it fills a browser tab, on a transparent field.
- app/favicon.ico: the same mark at 16, 32 and 48 pixels (PNG entries),
  for clients that ask for /favicon.ico without reading the page.
- app/apple-icon.png: 180 pixels on the white field of the BIMI logo,
  since iOS fills transparency with black.

The proxy rewrites paths per host, which would send /icon.svg on the
account, ViGet and the other hosts into their own page trees; the
matcher now skips the two new files as it already skipped favicon.ico,
so every Progmasoft host serves the same icons.

Provision the reserved accounts on the server

Publish ViGet plugins without putting the environment on a command line

Registration refuses the reserved names Progmasoft and Leitwolf, which are
meant to be created by trusted operations tooling only, and that tooling did
not exist: the Progmasoft account, the publisher of Progmasoft's Tazel
plugins on ViGet, could not be created at all.

- 'accounts provision-reserved <Name> <email>' runs with the configuration
  of the service, like the viget commands. It accepts only the reserved
  names, applies the rules of registration to the email address and the
  password, never replaces an existing account, and brings the account
  tables to the current schema first.
- The password is read from the terminal without echo, twice, or from one
  line of standard input when it is not a terminal; it never appears on a
  command line or in the output.
- AccountNamePolicy.TryNormalizeReserved checks a reserved name;
  TryNormalize, which registration uses, still refuses it.

Tests cover a reserved account created and signing in with its password,
a name that is not reserved, two different passwords, a weak password, an
existing account and the usage line. ops/README.md shows the command with
systemd-run --pty; docs/ACCOUNT-API.md points to it.

The documented command passed the variables of account.env to env as
arguments, which shows them in the process list to every user while it
runs. systemd-run reads the environment file itself, runs as the service
user with the production environment, and the JAR goes through a private
incoming directory. The publisher must be an existing account.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>