feat(shell-ui): vendor Commissioner + Fraunces web fonts locally (offline/CSP)

[stuffbucket]

What & why

The shipped UI still loaded its web fonts from fonts.googleapis.com — the last external asset dependency in the UI (Tailwind + Lucide are already vendored under shell/ui/dashboard/vendor/). This vendors the fonts too, so the webview never makes an external request: the app works fully offline and under a strict CSP, and it preserves the no-telemetry posture.

How

• Fetched the variable-weight woff2 files Google's css2 endpoint serves for the exact axes the UI requested (Commissioner wght@200..900, Fraunces opsz,wght@9..144,300..900) using a modern browser UA. Captured the latin + latin-ext subsets so accented logins / model names render without falling back.
• Dashboard — woff2 in shell/ui/dashboard/vendor/fonts/, @font-face added to style.css. Served verbatim (the dashboard vendor/ dir is already copied wholesale by the build). Commissioner only — the Dashboard has no Fraunces display moment (native titlebar carries the page name).
• Settings — woff2 in shell/ui/settings/vendor/fonts/, @font-face in an inline <style> in index.html. scripts/build-ui.ts now copies the settings vendor/ dir into the bundle output so the bare relative url()s resolve at /ui/settings/vendor/fonts/* (Bun's HTML bundler leaves bare relative url()s untouched). Fraunces (display) + Commissioner (body).
• Removed the fonts.googleapis.com <link rel="stylesheet"> from both index.html files. There were no preconnect links to remove.
• Fonts served with Content-Type: font/woff2 (already mapped in web-content-types.ts); production embed picks them up automatically (gen-ui-embed.ts walks the whole dist tree).

woff2 files added (variable font, one per subset)

File	Family / subset	Size
commissioner-latin.woff2	Commissioner · latin	36,696 B
commissioner-latin-ext.woff2	Commissioner · latin-ext	30,840 B
fraunces-latin.woff2	Fraunces · latin	67,388 B
fraunces-latin-ext.woff2	Fraunces · latin-ext	59,540 B

Commissioner is vendored under both surfaces (dashboard + settings) since the build serves them independently; Fraunces only under settings.

Smoke — CDN hard-blocked

Headless Chrome against the freshly-built UI (via ui-harness, serving the real shell/dist), with fonts.googleapis.com and fonts.gstatic.com resolver-mapped to 0.0.0.0 (--host-resolver-rules). Both pages render the correct self-hosted faces — Fraunces headings + Commissioner body on Settings, Commissioner on Dashboard. Had the local woff2 failed to load, text would fall back to the generic Georgia / Segoe stack (visibly different). Level achieved: full offline / CDN-blocked render.

(The Dashboard's "Usage request failed 404" banner is a ui-harness limitation — the mock backend doesn't serve the token-usage endpoint — not a font issue; the Period selector + banner text render in Commissioner.)

Settings (CDN blocked)

Dashboard (CDN blocked)

Checks

• bun run build:ui clean; shell tsc --noEmit clean (Bun.build doesn't typecheck)
• bun run typecheck clean
• bun run lint clean