[mikeh-lago]

Context

The app loads Inter and IBM Plex Mono from Google Fonts, so every page load calls fonts.googleapis.com and fonts.gstatic.com. Self-hosted and air-gapped installs can't reach those hosts, and the CSP has to allow them.

Description

• Add the @fontsource packages for Inter and IBM Plex Mono and import them in src/main.css next to the other global stylesheets, so the fonts are bundled with the app.
• Remove the Google Fonts <link> tags from index.html.
• Drop fonts.googleapis.com and fonts.gstatic.com from style-src and font-src in nginx/csp.conf.template.

Fixes LAGO-1986

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:58:03.148758Z	68d1bb1	PR opened
🔒 Security Review	✅ Completed 2026-10-26T22:57:59.653201Z	68d1bb1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[lago-claude-ai-agent]

Automated pre-review (advisory, not a required check) — verdict: HOLD · CI green

HOLD — Add focused regression coverage that fails on the previous setup and verifies the required Inter and IBM Plex Mono weights are sourced locally while Google Fonts origins are absent from index.html and the CSP.

[mikeh-lago]

Not adding these tests. Nothing in the repo tests index.html or nginx/csp.conf.template, so this would add a new kind of test that just checks a string is missing from a config file. It wouldn't protect much: if someone re-added the Google Fonts <link>, the tightened CSP would block it and the fonts would visibly fall back to Arial. The production build shows the Inter and IBM Plex Mono @font-face rules and font files are bundled, and E2E passes against them.