feat: host Google Fonts locally and tighten Content Security Policy

chore: add Google Search Console verification meta tag

feat: prepare transition to decoupled hosting (Render + Netlify + Supabase)