feat: host Google Fonts locally and tighten Content Security Policy

feat: prepare transition to decoupled hosting (Render + Netlify + Supabase)