Session 41: P0 audit fixes — MLB stat_types, broken routes, tier mismatch, self-hosted fonts (1940 tests)

- Backend: whitelist MLB stat_types in analyze.js + scan.js gates (mirrors
  python validation.py); fixes MLB scans 400ing.
- Routes: /settings -> /profile, /report -> /blog redirect pages.
- Profile: read tier from useAuth().tier (nav's source) to kill the
  Free-vs-DESK mismatch.
- Fonts: self-host Inter/JetBrains Mono/IBM Plex Mono via next/font, drop the
  503ing fonts.googleapis.com <link>; rewire literal font-family refs to vars.
- Kept /settings/security (real MFA page) intact — NOT clobbered to a redirect.
- +33 tests (1907 -> 1940), 149 suites; web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/app/upgrade/desk/page.tsx

@@ -149,7 +149,7 @@ export default function DeskUpgradePage() {
                 border: 'none',
                 background: cadence === c ? 'var(--bg-3)' : 'transparent',
                 color: cadence === c ? 'var(--text-0)' : 'var(--text-1)',
-                fontFamily: 'IBM Plex Mono, monospace',
+                fontFamily: 'var(--ibm-mono)',
                 fontSize: 12,
                 fontWeight: 700,
                 letterSpacing: '0.08em',
@@ -241,7 +241,7 @@ function TierCard({
       <ul style={{ listStyle: 'none', padding: 0, margin: '14px 0 0', display: 'grid', gap: 8 }}>
         {features.map((f) => (
           <li key={f} style={{ display: 'flex', gap: 8, alignItems: 'flex-start', fontSize: 14, color: 'var(--text-0)' }}>
-            <span aria-hidden style={{ color: 'var(--grade-a)', fontFamily: 'IBM Plex Mono, monospace' }}>›</span>
+            <span aria-hidden style={{ color: 'var(--grade-a)', fontFamily: 'var(--ibm-mono)' }}>›</span>
             <span>{f}</span>
           </li>
         ))}