Session 41: P0 audit fixes — MLB stat_types, broken routes, tier mismatch, self-hosted fonts (1940 tests)

- Backend: whitelist MLB stat_types in analyze.js + scan.js gates (mirrors
  python validation.py); fixes MLB scans 400ing.
- Routes: /settings -> /profile, /report -> /blog redirect pages.
- Profile: read tier from useAuth().tier (nav's source) to kill the
  Free-vs-DESK mismatch.
- Fonts: self-host Inter/JetBrains Mono/IBM Plex Mono via next/font, drop the
  503ing fonts.googleapis.com <link>; rewire literal font-family refs to vars.
- Kept /settings/security (real MFA page) intact — NOT clobbered to a redirect.
- +33 tests (1907 -> 1940), 149 suites; web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/analyze.js

@@ -55,6 +55,12 @@ const VALID_STAT_TYPES = new Set([
   // discriminates downstream).
   'goals', 'shots_on_target', 'shots', 'tackles', 'cards',
   'corners', 'saves', 'goals_conceded', 'passes', 'clean_sheet',
+  // MLB (Session 41) — mirrors src/services/python/utils/validation.py
+  // VALID_STAT_TYPES.mlb. The Scan frontend sends these IDs; the grading
+  // engine already processes them — this gate was the only thing rejecting.
+  'strikeouts', 'hits', 'home_runs', 'rbi', 'total_bases',
+  'walks', 'runs', 'earned_runs', 'innings_pitched',
+  'hits_allowed', 'stolen_bases',
 ]);
 
 const VALID_DIRECTIONS = new Set(['over', 'under']);