fix: patch google font → local at runtime to survive cached Stage 1

Stage 1 Docker image may be cached from before the font patch was added.
Apply the patch in start.sh at container start (idempotent grep check)
so the cached image is fixed without requiring a full Stage 1 rebuild.

- Dockerfile Stage 2: COPY vendor fonts + patch script to /opt/vendor/
- start.sh: patch layout.tsx files before next build if still on google font

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -179,6 +179,16 @@ COPY cloudflare-proxy-setup.py /opt/cloudflare-proxy-setup.py
 COPY cloudflare-worker.js /opt/cloudflare-worker.js
 COPY setup-uptimerobot.sh /opt/setup-uptimerobot.sh
 
+# Vendor fonts + patch script available at runtime.
+# Stage 1 may be cached from before the font patch was added; start.sh applies
+# the patch at container start if layout.tsx still imports next/font/google.
+COPY vendor/fonts/PlusJakartaSans-500-normal.woff2 \
+     vendor/fonts/PlusJakartaSans-500-italic.woff2 \
+     vendor/fonts/PlusJakartaSans-600-normal.woff2 \
+     vendor/fonts/PlusJakartaSans-600-italic.woff2 \
+     /opt/vendor/fonts/
+COPY vendor/patch-jakarta-font.js /opt/vendor/patch-jakarta-font.js
+
 RUN chmod +x /opt/start.sh /opt/setup-uptimerobot.sh
 
 EXPOSE 7860

start.sh

@@ -102,7 +102,7 @@ echo "Dashboard    : ${PUBLIC_URL}/"
 echo "Postiz UI    : ${PUBLIC_URL}/app/"
 echo "Postiz API   : ${PUBLIC_URL}/app/api/"
 echo "Sync every   : ${SYNC_INTERVAL}s"
-echo "HF backup    : ${HF_TOKEN:+enabled}${HF_TOKEN:-disabled (no HF_TOKEN)}"
+echo "HF backup    : $([ -n "${HF_TOKEN:-}" ] && echo 'enabled' || echo 'disabled (no HF_TOKEN)')"
 echo ""
 
 # ── Postgres ─────────────────────────────────────────────────────────────────
@@ -169,6 +169,23 @@ else
     echo "   Add HF_TOKEN as a Space secret to enable DB+uploads backup."
 fi
 
+# ── Patch next/font/google → next/font/local (runtime safety net) ────────────
+# Docker Stage 1 may be cached from before this patch was introduced.
+# Apply here unconditionally so the cached image is fixed at container start.
+# No-op if layout.tsx already uses next/font/local (idempotent grep check).
+_APP_LAYOUT="${POSTIZ_DIR}/apps/frontend/src/app/(app)/layout.tsx"
+if grep -q "next/font/google" "${_APP_LAYOUT}" 2>/dev/null; then
+    echo "Patching next/font/google → next/font/local (cached image lacks build-time patch)..."
+    mkdir -p "${POSTIZ_DIR}/apps/frontend/src/fonts"
+    cp /opt/vendor/fonts/*.woff2 "${POSTIZ_DIR}/apps/frontend/src/fonts/"
+    cd "${POSTIZ_DIR}"
+    node /opt/vendor/patch-jakarta-font.js
+    cd /
+    echo "Font patch applied."
+else
+    echo "Font patch: layout.tsx already uses next/font/local — skipping."
+fi
+
 # ── Build Next.js frontend (first boot or after next.config.js change) ───────
 # next build is NOT run during docker build — the HF builder's ~4 GB cgroup
 # limit is less than what next build needs. We run it here where the runtime