web: Snap Store badge, served from here

The badge image is vendored rather than hotlinked from snapcraft.io. The CSP
is img-src 'self' data: and would block it anyway, but the reason to leave the
CSP alone is the page's own claim: fetching a badge from someone else's server
hands them the address of every visitor to a page that says no servers are
involved.

The README badge stays dynamic — it reports the published version, and GitHub
proxies images, so no reader is exposed by it.

.dockerignore

@@ -21,3 +21,6 @@ assets/screenshots
 # full-size marketing captures stay out of the image, which is what the rule
 # above was for.
 !assets/screenshots/desktop-*.png
+# The Snap Store badge is served from this origin so the page makes no
+# third-party request; it has to actually ship for that to be true.
+!assets/badges/*.svg