Serve every font from this server and surface open tasks in 1.14.0

Fonts were still reachable from Google in two places. The editor and area
previews were handed `googleFonts` and no `localFonts`, so the screen used
most of the day fetched Lato from fonts.googleapis.com on every open; the
public page fell back to the same link whenever the files were missing.
Neither path remains: the template has no Google branch, `googleFontsUrl()`
is gone, and the policies name no foreign font host - `font-src 'self'`
publicly, `style-src 'self'; font-src 'self'` in administration. Without
local files a site now shows the theme's fallback and says so.

Preloading took the first two weights per family. The Kant-IT theme names
Lato 400, 700 and 900 and sets its headings on 800/900, so the one weight
that carried them loaded after the stylesheet and `font-display:swap`
swapped the heading in plain sight. Every weight of the theme is preloaded
now, latin subset, and the links sit before the stylesheet: measured cold,
all three files finish at 168 ms against a first paint at 292 ms.

Open tasks no longer hide on the screen that owns them. A strip above every
management screen names what needs a button and carries it: a new version
leads to System, missing fonts to Design. Neither asks the network - the
version comes from the daily update-check task, the fonts from a look in
the folder.

System and update was unusable on a phone: `.stack` is a grid whose
automatic column grows to its widest content, and one long database path
pushed the page sideways. It gets `minmax(0, 1fr)`, the backup table stacks
below 620px, and the prose is 45% shorter with the fine print folded away.

The device chips drew the current device with an outline, which lies outside
the box, ran under its neighbour and was clipped by the sidebar - it read as
a cut-off red frame. Used devices are filled in `#9d4e0d` now (5.6:1), the
current one carries a border inside the chip.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Twig/VersionExtension.php

@@ -2,25 +2,71 @@
 
 namespace App\Twig;
 
+use App\Content\FontLibrary;
+use App\Content\Theme;
 use App\Ops\Updater;
 use Twig\Extension\AbstractExtension;
 use Twig\TwigFunction;
 
 /**
- * The running version, for the administration shell.
+ * Fassung und offene Hinweise für die Verwaltungshülle.
  *
- * A function rather than a global, so the templates get exactly this one read-only answer and not
- * a whole updater with an update() method on it.
+ * Funktionen statt Variablen, damit die Vorlagen genau diese Antworten bekommen und nicht einen
+ * ganzen Updater mit einem update() daran.
  */
 final class VersionExtension extends AbstractExtension
 {
-    public function __construct(private Updater $updater, private \Doctrine\DBAL\Connection $db)
+    public function __construct(private Updater $updater, private \Doctrine\DBAL\Connection $db, private FontLibrary $fonts, private Theme $theme)
     {
     }
 
     public function getFunctions(): array
     {
-        return [new TwigFunction('kant_version', $this->updater->version(...)), new TwigFunction('kant_update_version', $this->available(...))];
+        return [
+            new TwigFunction('kant_version', $this->updater->version(...)),
+            new TwigFunction('kant_update_version', $this->available(...)),
+            new TwigFunction('kant_admin_notices', $this->notices(...)),
+        ];
+    }
+
+    /**
+     * Was auf jedem Verwaltungsbildschirm oben stehen soll, weil es einen Knopf braucht.
+     *
+     * Keine Zeile davon geht ins Netz: die verfügbare Fassung steht im Protokoll der täglichen
+     * Aufgabe, die fehlenden Schriften stehen als Dateien im Ordner. Ein Hinweis, der bei jedem
+     * Klick eine fremde Verbindung öffnet, wäre die Sorte Hinweis, die man abschaltet.
+     *
+     * @return list<array{kind: string, text: string, route: string, action: string, admin: bool}>
+     */
+    public function notices(): array
+    {
+        $notices = [];
+        if (null !== $version = $this->available()) {
+            $notices[] = [
+                'kind' => 'update',
+                'text' => sprintf('Fassung %s ist verfügbar; installiert ist %s.', $version, $this->updater->version()),
+                'route' => 'admin_system',
+                'action' => 'Jetzt aktualisieren',
+                'admin' => true,
+            ];
+        }
+        try {
+            $missing = $this->fonts->missing($this->theme->load());
+        } catch (\Throwable) {
+            // Eine Installation, die noch auf ihre Migrationen wartet, hat noch kein Theme.
+            $missing = [];
+        }
+        if ([] !== $missing) {
+            $notices[] = [
+                'kind' => 'fonts',
+                'text' => sprintf('Schriftdateien fehlen auf diesem Server: %s. Bis dahin zeigt die Website die Ersatzschrift.', implode(', ', $missing)),
+                'route' => 'admin_theme',
+                'action' => 'Schriften holen',
+                'admin' => false,
+            ];
+        }
+
+        return $notices;
     }
 
     public function available(): ?string