Polish pass: sysops wording, QR size, NWC toolbar, logo, diagnostics placement

Eight fixes from live testing:

Systems Operational modal:
- Drop the "test from your phone on mobile data" (hairpin NAT) sentence
  from the router note — too technical for the intended audience.
- Node-only role: when BTCPay Server and Lightning Wallet Connections
  (LNURL) are both off, the router card becomes a simple "No router
  setup needed yet" note explaining that ports 80/443 only matter if
  one of those services is turned on. When one is enabled, the card
  shows the same port steps and live domain/port diagnostics as the
  Desktop + Server role (diagnostics now poll only enabled services).

Service modals:
- The Domain Diagnostic Checklist now shows only the domain-active
  step (Domain Configured). DNS and port diagnostics live in Systems
  Operational, which shows the full checklist.
- Node-only role: BTCPay Server and Lightning Wallet Connections
  modals gain a "Ports to Forward in Your Router" section with the
  standard 80/443 wording and this computer's LAN address.
- Domain setup and reconfigure dialogs no longer contain router
  port-forwarding instructions (already handled during Desktop +
  Server onboarding and shown in Systems Operational).

Lightning Wallet Connections:
- Refresh and New Wallet toolbar buttons now share one height and
  baseline (a leftover 12px top margin on Refresh was offsetting it).
- The header status chip has a proper gap between the status dot and
  its label.

Zeus Connect / QR codes:
- QR codes render at the original 240px with the white frame and
  pixelated upscaling, restoring scannability.

Brand:
- The sidebar logo loads via /static/sovran-hub-icon.svg (same as the
  login page) instead of an inline <use> symbol — the gradient-heavy
  symbol did not render reliably. The icon sprite is hidden with the
  browser-safe zero-size pattern instead of display:none.

app/sovran_systemsos_web/static/css/modals.css

@@ -471,11 +471,13 @@
 }
 
 .creds-qr-img {
-  width: 150px;
-  height: 150px;
-  padding: 10px;
-  background: #edf4ef;
-  border-radius: 14px;
+  width: 240px;
+  height: 240px;
+  border-radius: 12px;
+  border: 4px solid #fff;
+  background-color: #fff;
+  image-rendering: pixelated;
+  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.4);
 }
 
 .creds-qr-hint {
@@ -912,6 +914,7 @@
 .nwc-header-chip {
   display: inline-flex;
   align-items: center;
+  gap: 6px;
   font-family: var(--mono);
   font-size: 0.66rem;
   font-weight: 600;
@@ -953,10 +956,22 @@
 .nwc-toolbar-actions {
   margin-left: auto;
   display: flex;
+  align-items: center;
   gap: 9px;
   flex-wrap: wrap;
 }
 
+/* Refresh + New Wallet share one height so the toolbar reads as one row */
+.nwc-toolbar-actions .matrix-form-back,
+.nwc-toolbar-actions .matrix-action-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 34px;
+  padding: 7px 16px;
+  font-size: 0.8rem;
+}
+
 .nwc-wallet-list { display: flex; flex-direction: column; }
 
 .nwc-wallet-card {
@@ -1031,7 +1046,6 @@
   overflow-wrap: anywhere;
 }
 
-.nwc-toolbar-refresh,
 .nwc-domain-required-btn { margin-top: 12px; }
 
 .nwc-intro-header { margin-bottom: 14px; }