feat: attach a self-describing ticket card to the email (1.6.1-aio.10)

The v1.6.1-aio.9 mail still scored 8.4/10 on mail-tester: the remaining
deduction was HTML_IMAGE_ONLY (1.8) — an HTML part whose only content of
note is a remote <img>. Remote images are also blocked by default in most
clients until the reader opts in, and a bare QR saved from that mail says
nothing about what it opens.

- New `qr.py` module (QR + logo helpers moved out of views_api) with
  `render_ticket_card`: site title, event name, when/where, the branded
  QR, name on ticket, ticket id and the door instruction, laid out with
  the bundled DejaVu Sans; `format_event_when` gives "Fri 19 Feb 2027,
  16:00 - 20:00"; filenames are `ticket-<event-slug>-<id8>.png`.
- `GET /events/api/v1/ticket-card/{ticket_id}` serves the same PNG
  (anonymous, like the QR endpoint); the email's "Ticket image" link
  now points there.
- The ticket email becomes multipart/mixed: text + HTML alternatives
  (URLs as links, no <img>) plus the card as a PNG attachment, which
  clients show inline at the end of the message and which works offline
  at the door.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYwoAkZZmXMMmaBp4WGUBo

tests/test_ticket_email.py

@@ -53,6 +53,25 @@ def test_email_carries_date_message_id_and_display_name(monkeypatch):
     assert parts == ["text/plain", "text/html"]
 
 
+def test_email_attaches_the_ticket_card(monkeypatch):
+    monkeypatch.setattr(settings, "lnbits_site_title", "Oyez!")
+    png = b"\x89PNG\r\n\x1a\n" + b"0" * 32
+    msg = build_ticket_email(
+        "tickets@example.org",
+        ["ada@example.com"],
+        "Subj",
+        "text",
+        "<p>html</p>",
+        attachments=[("ticket-test-8auNuuaB.png", png)],
+    )
+    assert msg.get_content_type() == "multipart/mixed"
+    body, attachment = msg.get_payload()
+    assert body.get_content_type() == "multipart/alternative"
+    assert attachment.get_content_type() == "image/png"
+    assert attachment.get_filename() == "ticket-test-8auNuuaB.png"
+    assert attachment.get_payload(decode=True) == png
+
+
 def test_payload_includes_event_details_and_qr(monkeypatch):
     monkeypatch.setattr(settings, "lnbits_baseurl", "https://lnbits.example/")
     subject, text, html = _ticket_notification_payload(_ticket(), _event())
@@ -65,5 +84,6 @@ def test_payload_includes_event_details_and_qr(monkeypatch):
         "at the door",
     ):
         assert needle in text
-    assert "/events/api/v1/qr/tkt1" in text
-    assert "<img" in html and "Ticket ID: tkt1" in html
+    assert "/events/api/v1/ticket-card/tkt1" in text
+    assert "<img" not in html and "Ticket ID: tkt1" in html
+    assert '<a href="https://lnbits.example/events/api/v1/ticket-card/tkt1">' in html