feat(type): self-host Manrope and DM Mono so they actually render

`styles.css` line 1 carried a malformed rule for the life of the site:

  @font-face{font-family:Manrope;src:url('https://fonts.googleapis.com/css2?...')}

`src:` in an @font-face must point at a font binary. That URL returns a CSS
stylesheet, so no browser could ever load a face from it. Every
`font-family:Manrope,Arial,sans-serif` fell through to Arial, and 'DM Mono' was
never declared as a family at all, so it fell through to generic monospace. The
intended typography has never once been seen.

Task 02 spotted this and was told to default to deleting the dead rule and
declaring the stacks that actually render. It recorded that decision, deferred
the deletion to "future component tasks", and nothing picked it up. The human
has now chosen the other branch: the real fonts.

Self-hosted rather than linked from fonts.googleapis.com because
scripts/audit-ui.mjs rejects any external <link>/<script>, and because the site
is presented in workshop rooms with unreliable networks. Latin and latin-ext
subsets only — the site is EN and PT-BR, so the cyrillic, greek and vietnamese
subsets Google also serves are dropped. Manrope ships as one variable file
covering 400-800. 89 KB total across six faces, all SIL OFL.

One public/fonts/fonts.css serves both trees, with relative url()s that each
consumer resolves against that file's own location: BaseLayout.astro links it
for Astro pages, the legacy root styles.css @imports it.

This changes how every page renders. That is the point, and it is the one
sanctioned visual change in the migration — screenshots taken before today show
Arial and are no longer a valid baseline. The three governing documents that
said "do not add a webfont" are updated so the next design-system-keeper does
not undo this.

Adds .stylelintignore, mirroring .prettierignore's legacy list for the same
reason: staging the minified styles.css to change one declaration produced ~180
declaration-block-single-line-max-declarations errors and blocked the commit.
public/fonts/fonts.css is deliberately excluded from that ignore list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plans/astro-refactor/task-02-tokens.md

@@ -50,7 +50,7 @@ walk into.
 
 ## Do not
 
-- Do not add a webfont.
+- Do not add a webfont. **(Reversed 2026-09-05 — see Decisions.)**
 - Do not rename tokens to numeric scales (`--color-neutral-900`).
 - Do not convert the `gap:1px` over a coloured parent trick into `border` — it
   is deliberate house style and appears everywhere.
@@ -60,7 +60,9 @@ walk into.
 - **Palette Consolidation:** The three drifted palettes were canonicalized into
   one. For `--blue`, `#527f9f` (from styles.css) was chosen over `#215675` (from
   chapters.css) to unify the look.
-- **Fonts:** The broken `@font-face` rule pointing to a Google Fonts stylesheet
-  was noted to be deleted in future component tasks. The font stacks will be
-  replaced with `Arial, sans-serif` and `ui-monospace, monospace` to match what
-  has actually been rendering all along. Zero visual change.
+- **Fonts (superseded 2026-09-05):** task 02 recorded "delete the dead rule,
+  fall back to `Arial, sans-serif` / `ui-monospace, monospace`, zero visual
+  change", and deferred even that deletion to "future component tasks", which
+  never picked it up. The human has since chosen the opposite: Manrope and DM
+  Mono are now self-hosted in `public/fonts/` and really render. The "Do not add
+  a webfont" line above no longer applies.