perf: self-host Inter and stop copying what can be linked

[oto-macenauer-absa]

What

The typeface stops being a third-party request, and the build stops paying for work it can skip.

Changes

Self-hosted Inter (#54)

Every page loaded Inter from fonts.googleapis.com, which sent each reader's IP and User-Agent to Google on every page view and left the deployment with one external dependency it otherwise does not have — mermaid is already vendored into each artifact for exactly this reason.

• @fontsource-variable/inter added; src/styles/marketplace.css declares the faces and --font-sans leads with 'Inter Variable'.
• Only the two latin subsets, upright are declared — what the old Google request asked for. Importing the package's own CSS would emit the cyrillic, greek and vietnamese faces into dist/ too; the unicode-range values are the package's, so another script still degrades to the fallback stack rather than rendering wrong. Two hashed woff2 files land in dist/_astro/, and font-display: swap is preserved.
• The two <link> tags are gone from Base.astro.
• CSP tightened: style-src and font-src no longer allowlist any external origin. nginx.headers.conf and the tests/fragment-server.mjs mirror move together, and tests/nginx-config.spec.js gains an assertion that neither directive names a host again.

Build-time costs (#51)

• Assets are hardlinked, not copied, from apps/{slug}/ into public/{slug}/, with a copy fallback when the filesystem will not link (EXDEV, no hardlink support). CSS is deliberately still a real copy: the url() rewrite edits the destination in place, and a link would write that edit straight back into the extracted artifact. There is a test for that specifically.
• The registry is no longer attached to every route. getStaticPaths returns one entry per HTML file and each carried the whole resolved registry, so the route table grew with apps × pages × apps. Each page now carries only its own app's {slug, name, icon}; Masthead takes activeApp instead of apps + activeSlug. To be precise about the win: these props are never serialised into the static HTML, so this is build memory, not output bytes.
• withFileTypes in collectHtmlFiles and copyAssets — the entry type comes from the directory read that already happened instead of a statSync per file, and a symlink is reported as one rather than followed.
• loadRegistry memoises, keyed on the mtimes of apps.json and apps/.single-page.json rather than on cwd alone, so a repeated getStaticPaths costs two statSync calls instead of two reads and parses while astro dev still picks up an edit.

Two items in #51 were already fixed and needed no change: copyDir moved to scripts/artifacts.js with withFileTypes when artifact extraction was hardened, and scripts/fetch-apps.js no longer dynamically imports copyFileSync.

Verification

• npm run build:headless — green, 8 apps; exactly two woff2 in dist/_astro/, no Google Fonts origin anywhere in the output
• npm test — 85 passed (was 82)
• npx playwright test --config=playwright.config.ci.js — 22 passed
• npm run test:container — 28 passed against a freshly built image, which is what proves the tightened CSP still renders (the in-browser CSP tests would catch a blocked font)
• npm run selftest (actions/publish-single-page-docs) — 20 passed
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities

Hardlinking verified directly: nlink=2 on copied assets, nlink=1 on rewritten CSS, and apps/…/depth-check.css still holding its original url(/fonts/…).

Closes #51
Closes #54