feat: custom brand name everywhere + a working client-facing site out of the box

User ask, paraphrased: install it, get help wiring up payments, and
immediately have a ready site under your own name — not "MBS Panel"
plastered everywhere and a bunch of manual follow-up.

Two things were actually broken/missing, found by tracing every surface
a real customer or the operator would see:

1. "MBS Panel" was hardcoded in ~20 places (bot messages, subscription
   page, admin panel splash/title/sidebar, legal pages, 2FA issuer,
   install.sh) with zero way to change it short of editing source.
   New BRAND_NAME config value (config.py default "MBS Panel", so this
   is 100% backward compatible for existing installs) wired through
   everywhere via the same live-settings pattern from the last commit
   (settings.get_brand_name(), no restart needed anywhere it's used).
   New Настройки → «Название» section in the admin panel to change it.

2. site/index.html and site/cabinet.html — a fully-built landing page +
   personal-cabinet template, already in the repo — were never actually
   served by anything. Not mounted by FastAPI, not deployed by
   install.sh, not linked from anywhere. Pure dead weight: a repo that
   looked like it shipped a client site but didn't. Now legal.py gets a
   render_site_page() (same {{TOKEN}} substitution + HTML-escaping as
   the existing offer/privacy renderer, new tokens: BRAND_NAME,
   SITE_DOMAIN, SUB_DOMAIN, BOT_USERNAME) and GET "/" serves the branded
   landing page on any host that isn't PANEL_DOMAIN (in practice:
   SUB_DOMAIN, which nginx already routes to this backend — zero
   install.sh/nginx/certbot changes needed, so this is live on every
   existing install without an upgrade step beyond `mbs update`).
   GET /cabinet.html serves the cabinet. Landing page's pricing section
   now fetches real, live prices from a new public GET /api/plans
   instead of showing static duration labels with no numbers.

Also fixed along the way, same staleness-bug class as the payments/HWID
fix last commit, found by grepping for every remaining frozen `from
config import ...` in api.py: BOT_TOKEN/BOT_USERNAME were still frozen
constants in api.py (mbs-api never restarts itself). Concretely this
meant: changing the bot via Настройки → Telegram-бот would leave
_tg_send_message (payment-received notifications) silently trying the
OLD token, admin_get_bot_settings showing the OLD username right after
a successful save, and gift-code links pointing at the OLD bot — all
until a manual mbs restart, same shape as the Platega-secret bug fixed
last commit. Added settings.bot_credentials(), wired it through every
call site (hoisted out of loops where relevant, same N+1 discipline as
always), removed the now-stale "выполни mbs restart" copy from the bot
settings hint.

legal.py's own BOT_USERNAME import was frozen too (used by the /offer
and /privacy {{BOT_USERNAME}} token) — switched to reading it live
in-module (no settings.py import from legal.py, would've been circular
since settings.py already imports legal.py for the env reader).

install.sh: new interactive prompt for the brand name (default "MBS
Panel", so hitting enter reproduces today's behavior exactly), written
to .env, echoed in the final summary along with the now-live site URL.

Verification: same story as always — api.py/bot.py still can't import
locally (no pydantic-core wheel for Python 3.14 on this machine).
py_compile + pyflakes clean across the whole repo. Real runtime test
against an isolated .env fixture: brand name and bot-credential live
reads (no reimport), render_site_page() token substitution correctness
on the actual site/index.html and site/cabinet.html files including an
XSS check (brand name containing <script> comes out HTML-escaped), and
a regression check that adding the BRAND_NAME token to the existing
legal.render() didn't break offer.html/privacy.html. Extracted
SUB_PAGE_TEMPLATE/SUB_PAGE_EXPIRED_TEMPLATE via ast from api.py (can't
import the module, but can pull the string constants) and ran the real
.format() calls against them to catch any brace-escaping mistake in the
new {brand_name} placeholder — CSS braces in those templates are
already double-escaped for .format(), easy to get wrong. Extracted and
node --check'd admin.html's whole inline script, div-tag-balance check
on the full file. install.sh's new prompt+heredoc snippet run standalone
with piped stdin (both a brand name with spaces and an empty/default
input), round-tripped the resulting .env back through the real
env-parsing logic. Extended the existing CI "app wiring" step (which
does import api/bot for real on Linux) with branding assertions calling
the actual route functions directly (api.root(), api.public_plans(),
api.public_branding()) — ran every part of that step's new logic that
doesn't need api.py locally first, to catch what's catchable before
trusting the rest to CI once the account's abuse-review lifts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

site/cabinet.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Личный кабинет — MBS Panel</title>
+<title>Личный кабинет — {{BRAND_NAME}}</title>
 <style>
   :root {
     --bg: #0a0b0f; --card: #131519; --border: #1e2128;
@@ -81,11 +81,11 @@
     </div>
     <div id="err"></div>
     <div id="content"></div>
-    <p class="hint">Токен выдаёт бот <a class="tglink" href="https://t.me/YourBot_robot" target="_blank">@YourBot_robot</a> — «Моя подписка»</p>
+    <p class="hint">Токен выдаёт бот <a class="tglink" href="https://t.me/{{BOT_USERNAME}}" target="_blank">@{{BOT_USERNAME}}</a> — «Моя подписка»</p>
   </div>
 
 <script>
-const API = "https://sub.example.com";
+const API = "https://{{SUB_DOMAIN}}";
 
 function esc(s) {
   if (s === null || s === undefined) return "";

site/index.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>MBS Panel</title>
+<title>{{BRAND_NAME}}</title>
 <style>
   :root {
     --bg: #0a0b0f; --card: #131519; --border: #1e2128;
@@ -117,7 +117,7 @@
 <body>
 <div class="wrap">
   <header>
-    <div class="logo">MBS Panel</div>
+    <div class="logo">{{BRAND_NAME}}</div>
     <nav>
       <a href="#features">Возможности</a>
       <a href="#plans">Тарифы</a>
@@ -128,7 +128,7 @@
   <section class="hero">
     <h1 class="reveal">Интернет без границ<br><span class="accent">и без замедлений</span></h1>
     <p class="reveal">Быстрый доступ к любимым сайтам и сервисам. Трафик не отличить от обычного HTTPS, скорость — на выделенных мощностях.</p>
-    <a class="btn reveal" href="https://t.me/YourBot_robot" target="_blank">Получить доступ</a>
+    <a class="btn reveal" href="https://t.me/{{BOT_USERNAME}}" target="_blank">Получить доступ</a>
   </section>
 </div>
 
@@ -164,23 +164,19 @@
 
   <section class="plans" id="plans">
     <h2 class="reveal">Тарифы</h2>
-    <div class="plan-row reveal">
-      <div class="plan"><div class="d">7 дней</div><div class="l">пробный</div></div>
-      <div class="plan"><div class="d">1 месяц</div><div class="l">стандарт</div></div>
-      <div class="plan"><div class="d">3 месяца</div><div class="l">выгодно</div></div>
-      <div class="plan"><div class="d">6 месяцев</div><div class="l">выгоднее</div></div>
-      <div class="plan"><div class="d">1 год</div><div class="l">максимум</div></div>
+    <div class="plan-row reveal" id="plan-row">
+      <div class="plan"><div class="d">…</div></div>
     </div>
   </section>
 
   <div class="cta reveal">
-    <a class="btn ghost" href="https://t.me/YourBot_robot" target="_blank">Выбрать тариф в боте</a>
+    <a class="btn ghost" href="https://t.me/{{BOT_USERNAME}}" target="_blank">Выбрать тариф в боте</a>
   </div>
 </div>
 
 <footer>
   <div class="wrap">
-    example.com — <a href="/cabinet.html">личный кабинет</a> — подписка через <a href="https://sub.example.com" target="_blank">sub.example.com</a> — <a href="/offer.html">оферта</a> — <a href="/privacy.html">конфиденциальность</a>
+    {{SITE_DOMAIN}} — <a href="/cabinet.html">личный кабинет</a> — подписка через <a href="https://{{SUB_DOMAIN}}" target="_blank">{{SUB_DOMAIN}}</a> — <a href="/offer">оферта</a> — <a href="/privacy">конфиденциальность</a>
   </div>
 </footer>
 
@@ -195,6 +191,22 @@
     });
   }, { threshold: 0.15 });
   document.querySelectorAll(".reveal").forEach((el) => io.observe(el));
+
+  function esc(s) {
+    return String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+  }
+
+  const PLAN_TAGLINES = { "7d": "пробный", "1m": "стандарт", "3m": "выгодно", "6m": "выгоднее", "1y": "максимум" };
+
+  fetch("/api/plans").then((r) => r.json()).then((data) => {
+    const row = document.getElementById("plan-row");
+    row.innerHTML = data.plans.map((p) => `
+      <div class="plan">
+        <div class="d">${esc(p.label)}</div>
+        <div class="l">${data.payments_enabled && p.price > 0 ? esc(p.price) + " ₽" : esc(PLAN_TAGLINES[p.code] || "")}</div>
+      </div>
+    `).join("");
+  }).catch(() => {});
 </script>
 </body>
 </html>

site/offer.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>MBS Panel — Публичная оферта</title>
+<title>{{BRAND_NAME}} — Публичная оферта</title>
 <style>
   :root {
     --bg: #0a0b0f; --card: #131519; --border: #1e2128;

site/privacy.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>MBS Panel — Политика конфиденциальности</title>
+<title>{{BRAND_NAME}} — Политика конфиденциальности</title>
 <style>
   :root {
     --bg: #0a0b0f; --card: #131519; --border: #1e2128;
@@ -36,7 +36,7 @@
   <h1>Политика конфиденциальности</h1>
   <p class="updated">Действует с {{EFFECTIVE_DATE}}</p>
 
-  <p>Настоящая политика описывает, какие данные собирает и как обрабатывает {{LEGAL_NAME}} (далее — «Оператор») при использовании Telegram-бота и сайта MBS Panel.</p>
+  <p>Настоящая политика описывает, какие данные собирает и как обрабатывает {{LEGAL_NAME}} (далее — «Оператор») при использовании Telegram-бота и сайта {{BRAND_NAME}}.</p>
 
   <h2>1. Какие данные собираются</h2>
   <ul>