Ship the fonts as assets instead of base64

[librowski]

Fonts stop being base64-inlined. Vite's library mode inlines every asset unconditionally (assetsInlineLimit has no effect there), so the built stylesheets carried 382 KB of font payload.

What changed — the @font-face rules are generated after Vite finishes, from the fontsource metadata, and the files are copied into dist/assets:

• Poppins 400 and 600 latin stay inlined — the only weights typography.css declares — so ordinary text needs no extra request and shows no swap flash.
• Every other face (Poppins 300/500/700, all latin-ext, Inter) is a .woff2 fetched on demand.
• Each face now carries unicode-range, which the per-subset fontsource stylesheets omit. Without it a browser has to consider both subsets; with it, a document without extended latin never fetches those files.
• The legacy .woff source is gone — that duplication is why twelve faces produced twenty-four payloads.

Sizes — ui/dist/index.css 509 KB → 150 KB, sdk/dist/style.css 591 KB → 230 KB, ui/dist/styles.css 7 KB → 32 KB (it now carries the two inlined faces). Ten .woff2 files ship in each package's dist/assets.

Why the SDK is in scope — it bundles the UI stylesheet into its own, so it carried the same payload; it now appends the generated block and copies the assets, reading them as artifacts from the UI build rather than importing its build code.

New gate — check-built-css fails when a stylesheet references an asset missing from dist. That is the failure mode this arrangement invites, and the one an earlier font change hit only on a clean CI install. Verified by deleting a file and watching the build fail.

For consumers — imports are unchanged, and the subpath path finally works as documented: styles.css now really does bring the typefaces. Two caveats, both in the changeset: a Content-Security-Policy naming font-src needs 'self' (or the serving origin) rather than data:, and the dist layout has to survive copying, since the stylesheets reference ./assets/*.woff2. Bundlers handle that themselves.

overview.mdx gains a short section listing what each style surface provides and what it does not — which also closes the gap a reviewer flagged on the typography PR, where subpath consumers were told to add styles.css for typography that then rendered in a system font.

Verified: ui/sdk lint and typecheck, build:ui, build:lib, stylelint, all test suites, docs build, demo build, and the asset gate proven by removing a font file.