Session 41: P0 audit fixes — MLB stat_types, broken routes, tier mismatch, self-hosted fonts (1940 tests)

- Backend: whitelist MLB stat_types in analyze.js + scan.js gates (mirrors
  python validation.py); fixes MLB scans 400ing.
- Routes: /settings -> /profile, /report -> /blog redirect pages.
- Profile: read tier from useAuth().tier (nav's source) to kill the
  Free-vs-DESK mismatch.
- Fonts: self-host Inter/JetBrains Mono/IBM Plex Mono via next/font, drop the
  503ing fonts.googleapis.com <link>; rewire literal font-family refs to vars.
- Kept /settings/security (real MFA page) intact — NOT clobbered to a redirect.
- +33 tests (1907 -> 1940), 149 suites; web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/app/settings/page.tsx

@@ -0,0 +1,13 @@
+import { redirect } from 'next/navigation';
+
+/**
+ * /settings (Session 41 — P0 audit fix).
+ *
+ * The audit found /settings 404'd. Account/preferences already live on
+ * /profile (the canonical surface), so forward there rather than build a
+ * second screen that would drift out of sync. Server-side redirect — no
+ * flash of an empty page.
+ */
+export default function SettingsPage() {
+  redirect('/profile');
+}