fix(privacy): bundle editor code and remove external font loading

[SHAURYAKSHARMA24]

Summary

Bundle Monaco and an editor worker, pin the already-installed peer as a direct dependency, use system fonts, and remove CDN script/font origins from shell CSP. Add real-browser local-editor regression. AI input disclosure remains in PR #547.

Linked issue

Related to #543.

Scope

Audit F6; baseline dev df0e82be3d7b2b7d846eefc1bcf82bde834936f2. This corrects independently verified existing behavior and advances the linked issue without adding product scope.

What changed

Bundle Monaco and an editor worker, pin the already-installed peer as a direct dependency, use system fonts, and remove CDN script/font origins from shell CSP. Add real-browser local-editor regression. AI input disclosure remains in PR #547.

Acceptance criteria completed

Implementation and targeted regression coverage below. See remaining work for conditions not verified.

Testing performed

5 explorer unit tests and 7 CSP cases passed; frontend lint/build and marketing lint/build passed. Actual Chromium explorer rendered local Monaco with zero external HTTP requests. Landing privacy copy corrected in both apps; bundle size and system-font visual review remain.

Current head: db0cb813c5a7b8b9a260c71b4281ea057c658c36; check snapshot appears below.

Screenshots

Local screenshots and browser measurements are recorded in the remediation delivery report where applicable. Backend-only changes use contract/regression evidence.

Security and data considerations

Preserves owner scoping, source provenance, sealed graph contracts and historical data. No security gate weakened. Rollback: revert this scoped commit; see issue for migration/deployment implications.

Dependencies and blocked work

Independent dev-based PR unless explicitly stated in the issue. No unmerged changes included.

Scope changes or remaining work

System font layout needs visual review; Firefox/Safari unavailable. Monaco production bundle is large (editor ~3.6MB uncompressed). Required current-head CI and review.

Please review @parthrohit22.

Contributor checklist

• Targets dev; dedicated fork branch from latest dev; issue claimed.

• Scope/evidence recorded; unrelated changes and secrets excluded.

• Targeted validation results reported accurately.

• Required current-head CI and maintainer review complete.

Current-head remediation validation

Head: db0cb813c5a7b8b9a260c71b4281ea057c658c36.

5 explorer unit tests and 7 CSP cases passed; frontend lint/build and marketing lint/build passed. Actual Chromium explorer rendered local Monaco with zero external HTTP requests. Landing privacy copy corrected in both apps; bundle size and system-font visual review remain.

System font layout needs visual review; Firefox/Safari unavailable. Monaco production bundle is large (editor ~3.6MB uncompressed). Required current-head CI and review.

Checks at delivery: Repository Hygiene: SUCCESS; Analyze (javascript-typescript): SUCCESS; Analyze (python): SUCCESS; API Contract Drift: SUCCESS; Frontend: FAILURE; Backend: SUCCESS; Docker Build: SUCCESS; Marketing Site: SUCCESS; Prototype Browser Acceptance: SKIPPED; Vercel: FAILURE; CodeQL: SUCCESS. Required checks/reviews must pass before merge; deployment authorization was not granted.

[vercel]

@SHAURYAKSHARMA24 is attempting to deploy a commit to the parthrohit60-3117's projects Team on Vercel.

A member of the Team first needs to authorize it.