Self-host the Inter webfont instead of loading it from Google Fonts at runtime

[oto-macenauer-absa]

Summary

Every page loads the typeface from Google's CDN:

<!-- src/layouts/Base.astro:70-74 -->
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
<link href="https://fonts.googleapis.com/css2?family=Inter:…&display=swap" rel="stylesheet" … />

Why change it

• Privacy / compliance. Each reader's IP and User-Agent go to Google on every page view. For an AbsaOSS-branded internal knowledge base this is the kind of third-party call that tends to be disallowed outright, and it has been ruled a GDPR issue in the EU.
• Availability. The deployment is otherwise fully self-contained (nginx serving static files, mermaid deliberately vendored rather than CDN-loaded — see the comment at actions/publish-single-page-docs/src/bundle.js:83-87). The font is the one remaining external dependency, so an air-gapped or restricted-egress environment renders in the fallback face.
• CSP. Adding a Content-Security-Policy (Security: single-page docs are rendered with raw HTML enabled and re-hosted same-origin without a CSP #42) means allowlisting fonts.googleapis.com and fonts.gstatic.com; self-hosting keeps the policy to 'self'.
• Performance. Two extra DNS+TLS handshakes to a third-party origin on first paint, and the CSS-then-font waterfall, versus same-origin fonts that nginx already serves with Cache-Control: immutable for a year (nginx.conf:45-48).

Suggested fix

Add @fontsource-variable/inter (or vendor the woff2 subset directly into public/fonts/), import it from src/styles/marketplace.css, and drop the two <link> tags. Keep font-display: swap.

Note the interaction with #49: self-hosted font url() references inside a sub-app's CSS are exactly the case the depth-assuming rewrite gets wrong, so it is worth doing after (or with) that fix.