panel: give each nav entry an icon

The bar was six similar-length words; nothing distinguished them at a
glance. Each entry now leads with a 16px inline SVG.

Inline rather than an icon font or a sprite file: the icons inherit the
entry's colour through currentColor, so the active pill's darker text and
a link's blue need no second rule, they cost no request, and they need no
exemption from the panel's default-src 'self' policy. Each is aria-hidden
because the entry's text is already its accessible name.

Account is included -- it is a page like the others and would otherwise
be the one bare word left in the bar -- so the highlight and padding
rules now cover the session block too, and the bar centres its items
instead of aligning them on the text baseline now that an entry is an
icon-plus-label row rather than a run of text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/templates_test.go

@@ -105,7 +105,9 @@ func TestNavMarksActivePage(t *testing.T) {
 		t.Fatalf("execute nav: %v", err)
 	}
 	out := buf.String()
-	if !strings.Contains(out, `<span aria-current="page">Mail queue</span>`) {
+	// The label is checked apart from the opening tag because each entry now
+	// carries an icon between the two.
+	if !strings.Contains(out, `<span aria-current="page">`) || !strings.Contains(out, `Mail queue</span>`) {
 		t.Errorf("active page is not marked:\n%s", out)
 	}
 	if strings.Contains(out, `href="/mail-queue"`) {
@@ -129,7 +131,7 @@ func TestNavLeadsWithStatusAndPointsDomainsAtItsOwnPath(t *testing.T) {
 		t.Fatalf("execute nav: %v", err)
 	}
 	out := buf.String()
-	if !strings.Contains(out, `<span aria-current="page">Status</span>`) {
+	if !strings.Contains(out, `<span aria-current="page">`) || !strings.Contains(out, `Status</span>`) {
 		t.Errorf("the status page is not marked active:\n%s", out)
 	}
 	if !strings.Contains(out, `href="/domains"`) {