Add banner in README

Author: samfrm

README.md

@@ -4,9 +4,17 @@
 [![Downloads](https://img.shields.io/github/downloads/samfrm/reflex/total.svg)](https://github.com/samfrm/reflex/releases)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.17079395.svg)](https://doi.org/10.5281/zenodo.17079395)
 
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/banner/reflex-banner-dark.png">
+    <img alt="Reflex — Local HTTPS referrer emulator" src="assets/banner/reflex-banner-light.png" width="100%">
+  </picture>
+</p>
+
 Emulate real inbound referrers in modern browsers — safely and repeatably.
 
 ✨ What it does
+
 - 🧭 Maps a referrer host to your machine (`/etc/hosts`)
 - 🔒 Serves a locally trusted HTTPS site (certs via mkcert)
 - 🚀 Redirects to your target so the browser sends a real `Referer`
@@ -32,7 +40,7 @@ Perfect for attribution tests, analytics pipelines, and E2E growth flows.
 
 ### 🚀 Quick Start
 
-1) One‑time — install mkcert local CA (all platforms)
+1. One‑time — install mkcert local CA (all platforms)
 
 • macOS: `brew install mkcert nss && sudo mkcert -install`
 
@@ -48,7 +56,7 @@ sudo cp -a "$(mkcert -CAROOT)/." /etc/mkcert/
 sudo chmod 755 /etc/mkcert && sudo chmod 644 /etc/mkcert/*
 ```
 
-2) Run a referrer → target flow
+2. Run a referrer → target flow
 
 ```bash
 sudo reflex run \
@@ -85,24 +93,25 @@ reflex --version
 - 🦫 Go 1.21+
 - 🔑 `mkcert` in PATH
 - 🏗️ Build: `go build ./cmd/reflex`
-- 📖 Help:  `go run ./cmd/reflex --help`
+- 📖 Help: `go run ./cmd/reflex --help`
 
 ### 🕹️ Commands
 
-- ▶️ `reflex run`     Start HTTPS server, spoof host, open browser
+- ▶️ `reflex run` Start HTTPS server, spoof host, open browser
 - 🧹 `reflex cleanup` Remove hosts entry and generated certs (add `--all` to wipe everything)
-- 🔍 `reflex status`  Show current state for a referrer
+- 🔍 `reflex status` Show current state for a referrer
 
 ### 🎛️ Flags you’ll actually use
 
-- 🔗 `--referrer`          Referrer URL or host (required)
-- 🎯 `--target`            Target URL to navigate to (required)
-- 🔁 `--method`            Redirect: meta (default), 302, js
-- 🛡️ `--referrer-policy`   `origin-when-cross-origin` (default) or `unsafe-url` for full URL
-- 🕶️ `--private`           Open browser in incognito/private mode (default true)
-- 🚫 `--no-browser`        Don’t auto‑open a browser
+- 🔗 `--referrer` Referrer URL or host (required)
+- 🎯 `--target` Target URL to navigate to (required)
+- 🔁 `--method` Redirect: meta (default), 302, js
+- 🛡️ `--referrer-policy` `origin-when-cross-origin` (default) or `unsafe-url` for full URL
+- 🕶️ `--private` Open browser in incognito/private mode (default true)
+- 🚫 `--no-browser` Don’t auto‑open a browser
 
 More:
+
 - ⏱️ `--delay` (meta/js, ms), 🔌 `--port` (default 443, falls back to 8443), 🗂️ `--keep-certs`, 🧪 `--no-hosts`, 🧹 `--force-unlock`
 
 ### 🩹 Troubleshooting (fast answers)
@@ -126,12 +135,13 @@ More:
 ### 🧰 Dev notes
 
 Code map:
-- 🧩 `cmd/reflex`  CLI
-- 🗂️ `internal/hosts`  Hosts manager
-- 🔑 `internal/certs`  mkcert bridge (Linux uses `/etc/mkcert`)
+
+- 🧩 `cmd/reflex` CLI
+- 🗂️ `internal/hosts` Hosts manager
+- 🔑 `internal/certs` mkcert bridge (Linux uses `/etc/mkcert`)
 - 🔒 `internal/server` HTTPS redirector
 - 🌐 `internal/browser` Browser opener (drops sudo → user, incognito)
-- 🛠️ `internal/util`   Port/lock/helpers
+- 🛠️ `internal/util` Port/lock/helpers
 
 🧪 Tests: `go test ./...` (unit tests generate self‑signed certs; no mkcert required)