Session 41: P0 audit fixes — MLB stat_types, broken routes, tier mismatch, self-hosted fonts (1940 tests)

- Backend: whitelist MLB stat_types in analyze.js + scan.js gates (mirrors
  python validation.py); fixes MLB scans 400ing.
- Routes: /settings -> /profile, /report -> /blog redirect pages.
- Profile: read tier from useAuth().tier (nav's source) to kill the
  Free-vs-DESK mismatch.
- Fonts: self-host Inter/JetBrains Mono/IBM Plex Mono via next/font, drop the
  503ing fonts.googleapis.com <link>; rewire literal font-family refs to vars.
- Kept /settings/security (real MFA page) intact — NOT clobbered to a redirect.
- +33 tests (1907 -> 1940), 149 suites; web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/components/Hero.tsx

@@ -133,7 +133,7 @@ function SportBadgeStrip() {
     >
       {SPORTS_DISPLAY.map((s) => {
         const base: React.CSSProperties = {
-          fontFamily: 'IBM Plex Mono, JetBrains Mono, monospace',
+          fontFamily: 'var(--ibm-mono)',
           fontSize: 11,
           fontWeight: 700,
           letterSpacing: '0.08em',

web/src/components/NotificationBell.tsx

@@ -173,7 +173,7 @@ export default function NotificationBell() {
               alignItems: 'center',
               justifyContent: 'center',
               boxShadow: '0 0 8px rgba(0, 212, 160, 0.7)',
-              fontFamily: 'IBM Plex Mono, monospace',
+              fontFamily: 'var(--ibm-mono)',
             }}
           >
             {unread > 9 ? '9+' : unread}
@@ -236,7 +236,7 @@ export default function NotificationBell() {
                     <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
                       <span
                         style={{
-                          fontFamily: 'IBM Plex Mono, monospace',
+                          fontFamily: 'var(--ibm-mono)',
                           fontSize: 10,
                           letterSpacing: '0.08em',
                           color: TYPE_TINT[n.type],