feat(sponsors): point TestMu AI at their own site

[Brooooooklyn]

TestMu AI (GitHub login LambdaTest-Inc, formerly LambdaTest — $100/mo, sliver tier) emailed asking for their sponsor card to link to their own site with UTM parameters instead of their GitHub profile.

The change

GitHub Sponsors API → RawSponsor{login, name, avatarUrl}
                              │
                    wash() ── lib/landing/sponsors.ts   ← only place `url` is built
                              │                            (`login` is dropped here)
                    ┌─────────┴─────────┐
              landing wall        /sponsors.{svg,png}

wash() is the single URL construction site, and it discards login, so the override has to live at that stage — anything downstream would have to reverse-engineer the login out of a URL string. One map covers both consumers.

Keyed on exact login casing, matching the EXCLUDED_LOGINS convention in load-sponsors.ts.

⚠️ This does not take effect on merge

The KV snapshot stores washed data (store.ts:161) and the SVG/PNG cards bake the href into their bytes (refresh.ts:107). Both read paths hit that cache, not wash().

trigger	latency
redeliver a sponsorship webhook from the napi-rs sponsors dashboard	~30s, then 0–10 min for the CDN
do nothing — daily 05:00 UTC cron	≤24 h

Note the cold-miss path on /sponsors.svg cannot self-heal: routes/sponsors.svg.ts:74 re-publishes the stale KV data it just read, so clearing R2 alone would re-bake the old URL.

Verified locally

Against the real Sponsors API, both surfaces render the override and no github.com/LambdaTest-Inc link remains:

$ curl -s localhost:5173/ | grep -o 'href="[^"]*testmuai[^"]*"'
href="https://www.testmuai.com/?utm_medium=sponsor&utm_source=napi-rs"

$ curl -s localhost:5173/sponsors.svg | grep -c 'github.com/LambdaTest-Inc'
0

The & correctly becomes & through escapeXmlAttr and decodes back with both UTM params intact.

Tests: override applies, non-overridden logins are untouched, and a lowercased login does not match. Full suite green (909 passed).

Not covered by this PR

Two parts of the sponsor's request are out of scope here:

1. Their README link. They asked for the link "in the GitHub README" too. README ![]() embeds render SVG in the browser's secure static mode where hyperlinks are inert — card.ts:87 already documents this. That needs an explicit markdown link in napi-rs/napi-rs, not a change here.
2. Their logo. They attached a 513×80 wordmark, but both sponsor surfaces render circular avatars (border-radius: 50%, borderRadius: size / 2). Their current GitHub avatar is already this logo's mark, correctly framed — so no change was needed. A local override would also have to be PNG/JPEG/GIF: avatars.ts:71 rejects SVG and silently drops the sponsor from the card.

---

🤖 Generated with Claude Code