Serve every font from this server and surface open tasks in 1.14.0

Fonts were still reachable from Google in two places. The editor and area
previews were handed `googleFonts` and no `localFonts`, so the screen used
most of the day fetched Lato from fonts.googleapis.com on every open; the
public page fell back to the same link whenever the files were missing.
Neither path remains: the template has no Google branch, `googleFontsUrl()`
is gone, and the policies name no foreign font host - `font-src 'self'`
publicly, `style-src 'self'; font-src 'self'` in administration. Without
local files a site now shows the theme's fallback and says so.

Preloading took the first two weights per family. The Kant-IT theme names
Lato 400, 700 and 900 and sets its headings on 800/900, so the one weight
that carried them loaded after the stylesheet and `font-display:swap`
swapped the heading in plain sight. Every weight of the theme is preloaded
now, latin subset, and the links sit before the stylesheet: measured cold,
all three files finish at 168 ms against a first paint at 292 ms.

Open tasks no longer hide on the screen that owns them. A strip above every
management screen names what needs a button and carries it: a new version
leads to System, missing fonts to Design. Neither asks the network - the
version comes from the daily update-check task, the fonts from a look in
the folder.

System and update was unusable on a phone: `.stack` is a grid whose
automatic column grows to its widest content, and one long database path
pushed the page sideways. It gets `minmax(0, 1fr)`, the backup table stacks
below 620px, and the prose is 45% shorter with the fine print folded away.

The device chips drew the current device with an outline, which lies outside
the box, ran under its neighbour and was clipped by the sidebar - it read as
a cut-off red frame. Used devices are filled in `#9d4e0d` now (5.6:1), the
current one carries a border inside the chip.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Controller/PageController.php

@@ -70,8 +70,6 @@ final class PageController extends AbstractController
     private function renderPage(Request $request, array $page, string $path, int $status = 200): Response
     {
         $styles = '';
-        $googleFonts = null;
-        $localFonts = [];
         // The page decides which header and footer it gets - including none.
         $areas = $this->areas($status >= 400 ? null : $page);
         $theme = $this->theme->load();
@@ -88,13 +86,11 @@ final class PageController extends AbstractController
         foreach ([...array_values($areas), ...array_values($sections)] as $extra) {
             $styles .= $this->styles->compileDocument($extra).$this->code->compileDocument($extra);
         }
-        // Liegen die Schriften auf dem eigenen Server, wird nichts von Google geholt - weder
-        // die Datei noch die IP-Adresse des Besuchers.
-        if ($this->fonts->hasLocal($theme)) {
-            $localFonts = $this->fonts->preload($theme);
-        } else {
-            $googleFonts = $this->theme->googleFontsUrl($theme);
-        }
+        // Schriften kommen ausschliesslich vom eigenen Server. Fehlen die Dateien, zeigt die
+        // Website die Ersatzschrift des Themes - nie ein Stylesheet von fonts.googleapis.com:
+        // das gaebe die IP-Adresse jedes Besuchers an einen Dritten weiter und haengt den
+        // Seitenaufbau an zwei fremde Verbindungen nacheinander.
+        $localFonts = $this->fonts->hasLocal($theme) ? $this->fonts->preload($theme) : [];
         $response = $this->render('page.html.twig', [
             'page' => $page,
             'canonical' => $status >= 400 ? null : rtrim($this->siteOrigin, '/').$this->settings->publicPath($path, $this->settings->homePath()),
@@ -133,7 +129,6 @@ final class PageController extends AbstractController
             // ist gar kein Bild, sondern der Hintergrund des ersten Abschnitts.
             'heroBackground' => $this->heroBackground($areas['header'] ?? null, $page['document']),
             'pageStyles' => $styles,
-            'googleFonts' => $googleFonts,
             'localFonts' => $localFonts,
             'styleBundle' => $this->bundle->url([] !== $localFonts),
         ], new Response(status: $status));
@@ -151,7 +146,7 @@ final class PageController extends AbstractController
             $response->headers->set('X-Robots-Tag', 'noindex, follow');
         }
 
-        return $this->shell($response, $wantsScript, $styles, null !== $googleFonts, $frames);
+        return $this->shell($response, $wantsScript, $styles, $frames);
     }
 
     /**
@@ -167,18 +162,15 @@ final class PageController extends AbstractController
      *                                 Nothing is added to the policy for an embed still waiting
      *                                 for consent.
      */
-    private function shell(Response $response, bool $allowScript = false, string $styles = '', bool $googleFonts = false, array $frameHosts = []): Response
+    private function shell(Response $response, bool $allowScript = false, string $styles = '', array $frameHosts = []): Response
     {
         $styleSources = ["'self'"];
         if ('' !== $styles) {
             $styleSources[] = sprintf("'sha256-%s'", base64_encode(hash('sha256', $styles, true)));
         }
+        // Stylesheets und Schriftdateien kommen nur von hier. Kein fonts.googleapis.com, kein
+        // fonts.gstatic.com - die Regel steht in der Kopfzeile und nicht nur in der Vorlage.
         $fontSources = ["'self'"];
-        if ($googleFonts) {
-            // Chosen deliberately: the stylesheet comes from Google and the files from its CDN.
-            $styleSources[] = 'https://fonts.googleapis.com';
-            $fontSources[] = 'https://fonts.gstatic.com';
-        }
         $response->headers->set('Cache-Control', 'no-store');
         $response->headers->set('X-Content-Type-Options', 'nosniff');
         $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');