website: self-host fonts so the display faces don't vanish offline

The homepage pulled Geist (body) from Google Fonts and Boska (display
serif) from Fontshare via CDN <link>s. When those hosts are blocked or
slow (e.g. mainland China), the fonts fail to load and the page falls
back to system serif/sans — the headings lose their Boska character.

Vendor the woff2 files into website/assets/fonts/ and declare them with
local @font-face rules (Geist variable 300–700 latin + latin-ext; Boska
400 regular + italic — the only weights/styles the page uses). No
external font requests remain. Verified in-browser: document.fonts
reports all four faces loaded and the headings render in Boska.

~110KB total, served same-origin.