Session 41: P0 audit fixes — MLB stat_types, broken routes, tier mismatch, self-hosted fonts (1940 tests)

- Backend: whitelist MLB stat_types in analyze.js + scan.js gates (mirrors
  python validation.py); fixes MLB scans 400ing.
- Routes: /settings -> /profile, /report -> /blog redirect pages.
- Profile: read tier from useAuth().tier (nav's source) to kill the
  Free-vs-DESK mismatch.
- Fonts: self-host Inter/JetBrains Mono/IBM Plex Mono via next/font, drop the
  503ing fonts.googleapis.com <link>; rewire literal font-family refs to vars.
- Kept /settings/security (real MFA page) intact — NOT clobbered to a redirect.
- +33 tests (1907 -> 1940), 149 suites; web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/vyndrDesignSystem.test.js

@@ -37,8 +37,11 @@ describe('Phase A — design tokens (§2)', () => {
   });
 
   it('sets --sans to Inter and --mono to JetBrains Mono', () => {
-    expect(css).toMatch(/--sans:\s*'Inter'/);
-    expect(css).toMatch(/--mono:\s*'JetBrains Mono'/);
+    // Session 41 — fonts are self-hosted via next/font, so the families now
+    // come through the --font-* variables (with the literal names kept as
+    // fallbacks for any non-next/font context).
+    expect(css).toMatch(/--sans:\s*var\(--font-sans\),\s*'Inter'/);
+    expect(css).toMatch(/--mono:\s*var\(--font-mono\),\s*'JetBrains Mono'/);
   });
 
   it('sets glitch intensity to the §2 baseline of 1 and scan-op to 0.04', () => {
@@ -48,9 +51,11 @@ describe('Phase A — design tokens (§2)', () => {
 });
 
 describe('Phase A — fonts (§2)', () => {
-  it('loads Inter (400–900) and JetBrains Mono (400–800) from Google Fonts', () => {
-    expect(layout).toContain('Inter:wght@400;500;600;700;800;900');
-    expect(layout).toContain('JetBrains+Mono:wght@400;500;600;700;800');
+  it('self-hosts Inter + JetBrains Mono via next/font (Session 41 — no CDN <link>)', () => {
+    expect(layout).toContain("from 'next/font/google'");
+    expect(layout).toContain('Inter(');
+    expect(layout).toContain('JetBrains_Mono(');
+    expect(layout).not.toMatch(/href=["'][^"']*fonts\.googleapis\.com/);
   });
 });