Self-host fonts and editor dependencies

[mre]

Summary

• replace Google Fonts with one locally hosted 47 KB Inter variable WOFF2 covering the used 400-700 range
• replace the global esm.sh import map and direct CDN imports with checked-in, minified esbuild bundles for CodeMirror, Lezer, Rust highlighting, and Vim mode
• preserve lazy loading through shared split chunks: Vim and the read-only solution viewer still load only when needed
• pin the frontend dependency graph with package-lock.json; production serves checked-in assets and does not require Node
• add CI that rebuilds static/dist and fails if generated bundles drift from source
• consolidate duplicate prose/cheatsheet Rust highlighting in one local module

Network result

Browser smoke testing shows:

• zero requests to fonts.googleapis.com, fonts.gstatic.com, or esm.sh
• local Inter font returns 200 font/woff2
• all 18 local /static/dist entries/chunks return 200
• editable CodeMirror mounts on dashboard, normal chapters, and tour
• read-only CodeMirror loads and mounts only after revealing a solution

Validation

• cargo fmt --all --check
• cargo clippy --locked --lib --bins -- -D warnings
• cargo test --locked --lib --bins
• ./scripts/check-examples.sh
• REQUIRE_COMPLETE=1 ./scripts/check-solutions.sh (75/75)
• npm ci --ignore-scripts
• npm run build:js
• syntax-checked every generated JS file
• npm audit --omit=dev (0 vulnerabilities)
• headless browser network and editor smoke tests