feat: add business branding to directory pages

[KitKat31337]

Summary

Bring public person and team directories into line with booking and manage pages by displaying the configured business branding and applying the existing head-code injection, Content Security Policy, and analytics-consent behavior.

This fixes two public-page inconsistencies:

• The configured business logo or name is missing from /u/{handle} and /team/{slug}.
• Admin-configured head HTML is loaded by the directory handler but never rendered, so custom CSS and other head code do not apply to directory pages.

Related issues:

• fix(directory): show the configured business logo on public directories KitKat31337/calnode#2
• fix(directory): apply configured head HTML on public directory pages KitKat31337/calnode#1

Problem

Booking and manage pages already display the instance’s business identity. Public directories instead show only the person or team identity, leaving visitors without the same business branding as the rest of the booking flow.

The directory handler also loads tracking settings and supplies HeadHTML to its template, but the template does not render that content. Additionally, directory responses do not use publicCSP(track), and the template omits the shared consent banner required by native GA4/GTM tracking.

These omissions mean the same instance-wide settings behave differently depending on which public page a visitor opens.

Changes

Shared business header

Extract the duplicated business-header markup from booking and manage templates into a shared businessHeader partial, then use it on all four public surfaces:

• Booking pages
• Manage pages
• Person directories
• Team directories

The header:

• Displays the configured logo when available.
• Uses the business name as the fallback when no logo is configured.
• Renders no header when neither is configured.
• Uses the business name as the logo’s escaped alternative text, falling back to Business logo when the name is empty.
• Constrains the header and logo to the available width.

Person and team avatars remain inside their directory cards, keeping the business identity separate from the person or team identity.

Configured logo sizing and opacity

Extend directory view data with LogoHeight and LogoOpacity, populated through the existing pageLogoHeight and opacityCSS helpers.

Directories therefore use the same normalized sizing and opacity behavior as booking and manage pages, rather than introducing a separate hard-coded logo size.

Head HTML and public CSP

Render the existing admin-configured HeadHTML exactly once in the directory’s <head>, after the shared tracking partial and before the booking stylesheet.

Set the directory response’s Content-Security-Policy using publicCSP(track), matching booking and manage pages.

This preserves the existing policy rules:

• Empty or whitespace-only head configuration retains the strict default when no native tracking tags are configured.
• Configured head code uses the existing CSP relaxation and allowlist behavior.
• Native GA4/GTM configuration receives the same policy as the other public pages.

The trusted-HTML boundary remains the authenticated tracking-settings configuration. Directory URL parameters cannot supply injected HTML.

Analytics consent

Include the shared consentBanner partial on directory pages so native GA4/GTM tracking uses the existing consent flow, including restoration of stored consent.

Documentation

Update docs/ARCHITECTURE.md and related comments to describe:

• Shared business branding across booking, manage, and directory pages
• Directory logo sizing and opacity
• Directory head-code injection and dynamic CSP
• Shared analytics-consent behavior

Compatibility and scope

The change reuses existing branding and tracking settings. It requires no database migration, new configuration, or API changes.

Booking and manage pages retain their existing logo/name selection and configured appearance through the shared partial, with an added fallback for logo alternative text.

Directory event filtering, ordering, booking links, team-member links, and person/team avatars remain intact. Banner images remain on their existing booking and manage surfaces.

Regression coverage

Added handler tests cover:

• Logo, name-only, and unconfigured branding across all four public surfaces
• Logo alternative text and HTML escaping
• Configured and normalized logo height and opacity
• Preservation of person and team avatars
• Placement of business branding above the directory card
• Head HTML rendered unescaped exactly once inside <head>
• Rejection of URL-supplied head HTML
• Directory CSP parity with booking and manage pages
• Empty settings, custom head HTML, CSP allowlists, native tracking tags, and combined configurations
• Consent-banner markup when native tracking is configured
• Preservation of directory titles, event links, and team-member links

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using deepseek-v4.1-flash ｜ 𝕏}