chore: self-host Geist fonts; drop Google Fonts dependency

[rado0x54]

Summary

• Stop ShellWatch from automatically fetching anything from fonts.googleapis.com / fonts.gstatic.com on page load.
• Self-host the Geist + Geist Mono variable fonts (latin / latin-ext / cyrillic woff2 subsets) under client/static/fonts/ so both the SvelteKit client (app.html / app.css) and the Fastify-rendered OAuth consent page (src/oauth/render.ts) reference one stable, same-origin URL.
• Add @fontsource-variable/geist and @fontsource-variable/geist-mono as production deps so the SIL OFL attribution is picked up by pnpm licenses:bundle.

After this change, the only automatic outbound traffic from a fresh ShellWatch instance is to its own origin. Web Push endpoints (FCM, Mozilla autopush, Apple Web Push, WNS) remain user-triggered only.

Test plan

• pnpm typecheck clean
• pnpm lint clean
• pnpm spdx:check clean
• pnpm build:client produces a bundle whose CSS contains all 6 @font-face rules and zero references to fonts.googleapis.com / fonts.gstatic.com
• Built artifacts at dist/client/fonts/ confirm the static adapter copies the woff2 files into the production output (so Fastify-served OAuth page hits the same files)
• Manual: load / in the browser, confirm Geist + Geist Mono render and DevTools shows woff2 requests only against the ShellWatch origin
• Manual: visit /oauth/authorize?..., confirm the consent page renders in Geist with no third-party network requests