feat: add the logo, and point people at the plugin before they mint a token

Logo: the app had no icon at all — public/ held only .gitkeep and the page
emitted no <link rel="icon">, so browsers requested /favicon.ico, got a 404
and showed a blank tab. app/icon.svg is picked up automatically by the App
Router; public/logo.svg is a currentColor variant for in-app use.

The mark is three retrieval signals converging on a single memory, which is
what the search actually does (vector + full-text + tags fused by RRF) and
what the product does (many sessions, one store). Checked at 16px: the outer
strokes are held at equal opacity because asymmetry read as a rendering
artifact rather than as ranking.

Tokens page: reframed so a bearer token is the exception rather than the
default. A token is a credential to store and rotate; the plugin just signs
you in. The install hint renders only when PLUGIN_MARKETPLACE_URL is set —
a copyable command pointing nowhere is worse than no command.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/settings/tokens/page.tsx

@@ -108,6 +108,44 @@ async function revokeTokenAction(formData: FormData) {
   revalidatePath("/settings/tokens");
 }
 
+/**
+ * Points people at the plugin before they mint a token they don't need.
+ *
+ * Rendered only when this instance knows which marketplace it's published
+ * from — showing a copyable command that points nowhere is worse than showing
+ * nothing.
+ */
+function PluginHint({
+  marketplaceUrl,
+  marketplaceName,
+}: {
+  marketplaceUrl: string | undefined;
+  marketplaceName: string;
+}) {
+  if (!marketplaceUrl) return null;
+  return (
+    <Card className="mb-6">
+      <CardHeader className="text-sm font-medium text-fg">
+        If this machine has a browser, install the plugin instead
+      </CardHeader>
+      <CardBody>
+        <p className="text-sm text-fg-muted mb-3">
+          The plugin signs you in through {" "}
+          <span className="text-fg">your usual login</span>, so there&apos;s no
+          token to copy, store, or rotate. Generate a token below only when a
+          browser sign-in isn&apos;t possible.
+        </p>
+        <pre className="text-xs !whitespace-pre-wrap !break-all select-all">
+          {[
+            `claude plugin marketplace add ${marketplaceUrl}`,
+            `claude plugin install shared-memory@${marketplaceName}`,
+          ].join("\n")}
+        </pre>
+      </CardBody>
+    </Card>
+  );
+}
+
 export default async function TokensPage() {
   const session = await auth();
   const userId = session!.user.id;
@@ -144,7 +182,12 @@ export default async function TokensPage() {
     <Container className="pt-6 max-w-3xl">
       <PageHeader
         title="CLI tokens"
-        description={`Long-lived bearer tokens for MCP clients without browser access. ${ttlDays}-day expiry per token.`}
+        description={`For machines that can't complete a browser sign-in — headless containers, CI runners, sealed devboxes. Tokens last ${ttlDays} days and can be revoked one at a time.`}
+      />
+
+      <PluginHint
+        marketplaceUrl={env().PLUGIN_MARKETPLACE_URL}
+        marketplaceName={env().PLUGIN_MARKETPLACE_NAME}
       />
 
       <Card className="mb-6">

apps/web/app/icon.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="shared-memory">
+  <title>shared-memory</title>
+  <rect width="64" height="64" rx="14" fill="#11151b"/>
+  <!--
+    Three retrieval signals - vector, full-text, tags - converging on a single
+    memory. The direct match runs straight through at full strength; the two
+    ranked neighbours fall back, which is the fusion the search actually does.
+    Opacity is held equal on the outer pair so the mark stays balanced at 16px.
+  -->
+  <g fill="none" stroke-linecap="round" stroke-width="7">
+    <path d="M13 15C25 15 26 32 35 32" stroke="#0092fd" opacity=".55"/>
+    <path d="M13 32H35" stroke="#49a9ff"/>
+    <path d="M13 49C25 49 26 32 35 32" stroke="#0092fd" opacity=".55"/>
+  </g>
+  <circle cx="45" cy="32" r="7.5" fill="#76c0ff"/>
+</svg>