handoff pass: vendored sveltia bundle, astro pinned ^7.2.10, root README + refreshed deploy runbook, review fixes (coverless card grid, shared NewsCard/lib, real site origin, nginx security headers, linger step, dead config removed, preview.css sync, tsconfig)

DESIGN.md

@@ -43,17 +43,17 @@ Type scale — the ONLY font sizes in the codebase (no ad-hoc rem values):
 | `--fs-h1` | clamp(2.25–3.5rem) | Page/article headlines |
 | `--fs-display` | clamp(2.5–4.75rem) | Home hero only |
 
-Always end `font-family` with a generic (`sans-serif`) — lint requirement.
+Font tokens end with a generic (`sans-serif`); use them bare —
+`var(--font-body), sans-serif` doubles the generic.
 
-Font loading (decided after the navigation-blink incident): self-hosted latin
-woff2, preloaded in `Base.astro`, `font-display: swap` + metric-matched Arial
-fallbacks for BOTH families (`Inter Fallback`, `Space Grotesk Fallback` —
-size-adjust/ascent/descent computed from the real font metrics, capsize
-method). Never `optional`: its ~100ms window loses to per-navigation
-revalidation (dev/preview serve `Cache-Control: no-cache`), which randomly
-committed whole pageviews to Arial — the "fonts flash between navigations"
-bug. With swap + matched metrics every page converges on brand fonts and the
-swap is layout-neutral.
+Font loading (prevents any navigation blink): BOTH families are inlined as
+base64 `data:` URIs inside the render-blocking `global.css` — no separate
+font fetch exists, so there is no swap window and no font flash between
+navigations. Metric-matched Arial fallbacks (`Inter Fallback`,
+`Space Grotesk Fallback` — size-adjust/ascent/descent computed from the real
+font metrics, capsize method) cover only the pre-CSS paint. The standalone
+`public/fonts/*.woff2` files are referenced ONLY by
+`public/admin/preview.css` (CMS entry preview) — they look unused but aren't.
 
 ## Spacing scale (fluid; mobile ≈ min, desktop ≈ max)
 
@@ -305,8 +305,8 @@ inventing a section order. The navy band is reserved for `/` and `/login`.
 
 ## Serving the demo
 
-Phone/tunnel demos run the **production build**: `npm run demo`
-(= `astro build && astro preview`, same port 4321 so the tunnel URL keeps
+Phone/tunnel demos run the **production build**:
+`npm run build && npm run preview` (same port 4321 so the tunnel URL keeps
 working). `astro dev` through the tunnel adds HMR + dev-toolbar module
 traffic and serves everything `no-cache` — every navigation re-negotiates
 assets over the tunnel, which reads as blinking/slow paints that do NOT