feat(ui): serve htmx, Chart.js, Gridstack and the house fonts from Steward itself (#5091)

#5091 "Local assets". base.html, the dashboard and the share view loaded
htmx and Chart.js from unpkg/jsdelivr, Gridstack from jsdelivr and their
fonts from Google. On an instance with no outbound network (rule 164) every
page lost htmx, and so every button and poll; and each page load told those
hosts about the visitor (rule 155).

- steward/static/vendor: htmx 2.0.4, Chart.js 4.4.4, Gridstack 12.6.0 (the
  versions the pages already used), with their licences (0BSD, MIT, MIT).
- steward/static/fonts: Inter, Fraunces and JetBrains Mono, the design
  system's faces (SIL OFL, licences beside them), every unicode-range
  subset, with fonts.css. The serif face is now Fraunces in place of
  EB Garamond (base) and Libertinus Serif (share view); applying Inter and
  the type scale is the tokens step.
- Templates use url_for('static'); /static already passes every gate.
- Guard (tests/test_no_remote_assets.py): no template or stylesheet loads a
  script, stylesheet, font or image from another origin (comments stripped,
  example URLs in help text allowed), with a self-test that it can fail;
  every url_for('static') file and every font the sheet names exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/base.html

@@ -12,11 +12,10 @@
       });
     </script>
     <title>{% block title %}Steward{% endblock %}</title>
-    <script src="https://unpkg.com/htmx.org@2.0.4/dist/htmx.min.js"></script>
-    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.4/dist/chart.umd.min.js"></script>
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=EB+Garamond:ital,wght@0,400;0,600;0,700;1,400&display=swap" rel="stylesheet">
+    {# Every asset is served by Steward itself: it runs with no outbound network (rule 164). #}
+    <script src="{{ url_for('static', filename='vendor/htmx-2.0.4.min.js') }}"></script>
+    <script src="{{ url_for('static', filename='vendor/chart-4.4.4.umd.min.js') }}"></script>
+    <link rel="stylesheet" href="{{ url_for('static', filename='fonts/fonts.css') }}">
     <style>
 :root {
   --bg: #131315;
@@ -41,7 +40,7 @@
   --orange-dim: #2a1a10;
   --red: #c84048;
   --red-dim: #2a1014;
-  --font-serif: 'EB Garamond', Georgia, serif;
+  --font-serif: 'Fraunces', Georgia, serif;
 }
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: var(--bg); color: var(--text); line-height: 1.5; }