reference: Geist Sans + Geist Mono, self-hosted, zero third-party requests

The API reference asked fonts.scalar.com for 13 webfonts on every load. Our CSP
is font-src 'self' data:, so all 13 were blocked — 13 failed requests, 13 console
errors, and type that silently fell back to whatever the OS happened to have, on
our most public developer-facing page.

Naming Geist in a font stack did not fix it: nothing self-hosted it, so
@font-face resolved to an empty list and Geist only appeared for people who
happened to have it installed. Measuring the live page is what caught that.

Now the fonts actually ship: Geist-Variable.woff2 and GeistMono-Variable.woff2
beside the bundle. One VARIABLE file per family covers weights 100-900, so the
whole thing is two same-origin requests (~141KB) instead of ten static cuts.

Wired through Scalar's own seam — it reads --scalar-font / --scalar-font-code
everywhere it sets type, so overriding those two properties beats an !important
war against its selectors and survives a bundle upgrade.

Deleted the 13 dead @font-face blocks from the vendored bundle rather than
leaving them neutered: 15 font declarations where 2 suffice is the same
complecting in miniature. Two rules, one place. Verified the bundle still parses
and that the reference directory now contains ZERO external hosts.

apps/docs/public/reference/index.html

@@ -30,25 +30,45 @@
         font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
         text-align: center;
       }
-      /* Scalar's bundled @font-face rules pointed at fonts.scalar.com, which our
-         CSP blocks (font-src 'self' data:) — 13 failed requests per load. Those
-         rules are patched out of the vendored bundle, so nothing is fetched.
-         Brand stack: Geist Sans for text, Geist Mono for code. NOTE: this static
-         page is outside Next's font pipeline, so Geist is NOT self-hosted here —
-         it resolves when locally installed and falls back cleanly otherwise.
-         Self-hosting it (copy the woff2 into /reference/fonts/ + @font-face)
-         would make it exact; the fallbacks below keep it honest until then. */
+      /* Geist Sans + Geist Mono, SELF-HOSTED. Nothing is fetched from
+         fonts.scalar.com: the bundle shipped 13 @font-face rules pointing there,
+         our CSP is font-src 'self' data:, so all 13 were blocked on every load
+         and the type silently fell back to whatever the OS had. Those rules are
+         patched out of the vendored bundle AND the real fonts now ship beside it.
+
+         One variable file per family covers every weight (100-900), so this is
+         two requests, same-origin, ~141KB total — not ten static cuts. */
+      @font-face {
+        font-family: 'Geist';
+        font-style: normal;
+        font-weight: 100 900;
+        font-display: swap;
+        src: url('/reference/fonts/geist-sans.woff2') format('woff2');
+      }
+      @font-face {
+        font-family: 'Geist Mono';
+        font-style: normal;
+        font-weight: 100 900;
+        font-display: swap;
+        src: url('/reference/fonts/geist-mono.woff2') format('woff2');
+      }
+      /* Scalar's OWN theming seam — it reads these custom properties everywhere
+         it sets type, so overriding them beats fighting its selectors with
+         !important and survives a bundle upgrade. */
+      :root,
+      .scalar-app {
+        --scalar-font: 'Geist', ui-sans-serif, system-ui, -apple-system, sans-serif;
+        --scalar-font-code: 'Geist Mono', ui-monospace, 'SF Mono', Menlo, monospace;
+      }
       body,
       .scalar-app {
-        font-family: 'Geist Sans', Geist, ui-sans-serif, system-ui, -apple-system,
-          'Segoe UI', sans-serif;
+        font-family: var(--scalar-font);
       }
       code,
       pre,
       .scalar-app code,
       .scalar-app pre {
-        font-family: 'Geist Mono', ui-monospace, 'SF Mono', Menlo, Monaco,
-          'Cascadia Mono', monospace;
+        font-family: var(--scalar-font-code);
       }
 </style>
   </head>
@@ -56,10 +76,9 @@
     <div id="app"></div>
 
     <!-- Full interactive reference for the unified Hanzo API (hanzo.yaml).
-         The Scalar bundle and the spec ship with this static export; the only
-         external request Scalar attempts is its own webfont CDN, which our CSP
-         blocks by design (we pin Geist above instead). Served by hanzoai/static
-         at docs.hanzo.ai/reference/. -->
+         The Scalar bundle, the spec, and the two Geist woff2 files all ship with
+         this static export, so the page makes ZERO third-party requests. Served
+         by hanzoai/static at docs.hanzo.ai/reference/. -->
     <script
       id="api-reference"
       type="application/json"