/* Self-hosted fonts for the public pages (#1812), served at /static/fonts/. The token-reveal pages (#1815) read the same files at /app/fonts/ through reveal-fonts.css, because the app host does not reach /static. That file adds the cyrillic, cyrillic-ext and vietnamese subsets, which the public pages do not ship; its header says why. The customer app bundles the same Inter and Spectral families from the @fontsource npm packages (frontend/src/main.tsx). The public pages cannot import that bundle: the app host serves only /app and /api/v1, so nothing under /app is reachable from the public host. They read these copies instead, which is what lets the public Content Security Policy name no third-party font host. Provenance: the woff2 files and the @font-face blocks below are fontsource 5.3.0, the version frontend/package.json pins for Inter and Spectral. IBM Plex Mono is not an app dependency. Its files come from the @fontsource/ibm-plex-mono 5.3.0 tarball, checked against the registry integrity sha512-eTgnZjZEGk1QtD3ZstF+Vclo2HLAni8YMy34/DxllwZvyz1lR/1RF/xTiAquOBO7MvqBx8D2Ig2WCPMVfdZu7Q== on 2026-10-27. All three families are SIL OFL 1.1; the license texts sit beside the fonts as OFL-*.txt and must stay with them. Only the latin and latin-ext subsets are copied, as Google's stylesheet split them, with the same unicode-range, so a character outside them falls back exactly as it did before. The public templates contain no text from the Cyrillic, Greek or Vietnamese subsets. To refresh, copy the matching files/*-latin*--