feat: attach a self-describing ticket card to the email (1.6.1-aio.10)

The v1.6.1-aio.9 mail still scored 8.4/10 on mail-tester: the remaining
deduction was HTML_IMAGE_ONLY (1.8) — an HTML part whose only content of
note is a remote <img>. Remote images are also blocked by default in most
clients until the reader opts in, and a bare QR saved from that mail says
nothing about what it opens.

- New `qr.py` module (QR + logo helpers moved out of views_api) with
  `render_ticket_card`: site title, event name, when/where, the branded
  QR, name on ticket, ticket id and the door instruction, laid out with
  the bundled DejaVu Sans; `format_event_when` gives "Fri 19 Feb 2027,
  16:00 - 20:00"; filenames are `ticket-<event-slug>-<id8>.png`.
- `GET /events/api/v1/ticket-card/{ticket_id}` serves the same PNG
  (anonymous, like the QR endpoint); the email's "Ticket image" link
  now points there.
- The ticket email becomes multipart/mixed: text + HTML alternatives
  (URLs as links, no <img>) plus the card as a PNG attachment, which
  clients show inline at the end of the message and which works offline
  at the door.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYwoAkZZmXMMmaBp4WGUBo

README.md

@@ -62,10 +62,13 @@ Events includes a shareable ticket scanner, which can be used to register attend
 - **Stripe session.** The buyer's email is passed as `customer_email`
   (prefilled and locked on the hosted page); the line item is named after the
   event; `event_id`, `quantity` and `ticket_ids` ride along as metadata.
-- **Email.** Multipart text + HTML with the ticket QR embedded from
-  `GET /events/api/v1/qr/{ticket_id}` (PNG, branded with the instance QR logo).
-  `POST /events/api/v1/tickets/{ticket_id}/resend-email` returns a
-  `TicketResendResult` with per-channel outcome.
+- **Email.** Multipart text + HTML (links, no images) with the **ticket card**
+  attached — a self-describing PNG (site, event, when, where, QR with the
+  instance logo, name on ticket, ticket id) also served at
+  `GET /events/api/v1/ticket-card/{ticket_id}`; the bare QR stays at
+  `GET /events/api/v1/qr/{ticket_id}`. Headers carry Date, Message-ID and a
+  From display name (site title). `POST /events/api/v1/tickets/{ticket_id}/resend-email`
+  returns a `TicketResendResult` with per-channel outcome.
 
 ## Powered by LNbits