Security hardening: drop npm deps and self-host Outfit font

- Remove package.json / package-lock.json. The only dependency was
  claude-flow (dev tooling, never loaded by the game), which pulled in
  49 known vulnerabilities (2 critical, 28 high) and could be installed
  by the Cloudflare Pages build.
- Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL)
  in fonts/ instead of loading it from Google Fonts. This removes the
  last third-party origins from the CSP (style-src / font-src are now
  'self' only), stops sending visitor IPs to Google, and makes the font
  work offline.
- Precache the font files in the service worker and bump CACHE_NAME to
  tortugotchi-v18.

style.css

@@ -1,3 +1,25 @@
+/* ==========================================================================
+   FONTS — self-hosted Outfit variable font (SIL OFL 1.1, see fonts/OFL.txt)
+   ========================================================================== */
+/* latin-ext */
+@font-face {
+  font-family: 'Outfit';
+  font-style: normal;
+  font-weight: 400 800;
+  font-display: swap;
+  src: url('fonts/outfit-latin-ext.woff2') format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Outfit';
+  font-style: normal;
+  font-weight: 400 800;
+  font-display: swap;
+  src: url('fonts/outfit-latin.woff2') format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
 /* ==========================================================================
    DESIGN TOKENS & SYSTEM ROOT
    ========================================================================== */