- Drops all fonts.googleapis.com / fonts.gstatic.com references
- Adds self-hosted woff2 under public/fonts/
- @font-face with font-display: swap
- Test asserts no external font refs in generated HTML
Closes GDPR contradiction: privacy policy promises 'no third-party tracking'
and 'EU-hosted' while every page was leaking visitor IPs to Google (Munich
District Court 2022 ruling, €100/visitor damages precedent).
