feat: custom IDE Font

[KayleeWilliams]

Summary

Adds custom font support to the IDE so users can now control IDE & Terminal, not jsut Terminal

Screenshots

Testing

• pnpm lint
• pnpm typecheck
• pnpm test
• [] pnpm build
• Added or updated high-quality tests that would catch regressions, or explained why tests were not needed

AI Review Report

I reviewed the PR for scope, persistence behavior, renderer application, and settings UI
consistency.

Main risks checked:

• The default font remains unchanged (Geist).
• Terminal and Monaco/editor font settings remain separate and unchanged.
• Existing settings persistence safely merges the new appFontFamily field for new and existing
  installs.
• The new font-family CSS value is built through a small helper with a stable fallback chain.
• Settings search finds the new control via IDE Font, font, typography, orca, interface, app, and
  ui.
• Existing font autocomplete behavior is reused rather than introducing a new control.

What was changed or verified:

• Added appFontFamily defaulting to Geist.
• Added buildAppFontFamily() tests for default, custom, and duplicate fallback handling.
• Added persistence test assertions for default and update behavior.
• Ran focused tests and type checks:
  • focused Vitest for app font + persistence
  • typecheck:web
  • typecheck:node
  • typecheck:cli
  • oxlint on touched files
  • git diff --check

Cross-platform compatibility was explicitly checked for macOS, Linux, and Windows:

• Shortcuts: no keyboard shortcut handling was changed.
• Labels: no platform-specific shortcut labels were changed.
• Paths: no file path handling was added or changed.
• Shell behavior: no terminal shell, PTY, SSH, or command-launch behavior was changed.
• Electron platform differences: the change is renderer CSS/settings only; no Electron main-
  process platform APIs were added or changed.
• Font fallback chain includes system-safe CSS fallbacks and remains browser-renderer based.

Security Audit

Reviewed security-relevant surfaces:

• Input handling: the user-provided font family is treated only as a CSS font-family value. It is
  quoted with JSON.stringify() unless it is a known CSS generic/system keyword or -apple-system,
  reducing malformed CSS risk.
• Command execution: no new command execution was added.
• Path handling: no new path construction, filesystem paths, or path parsing was added.
• Auth/secrets: no auth, token, cookie, keychain, or secret handling was touched.
• Dependencies: no new dependencies were added.
• IPC: reused existing settings:get, settings:set, and settings:listFonts; no new IPC channels
  were added.
• Persistence: new field is stored as normal user preference data only.

Follow-up needed:

• None required for security. A future hardening option would be to cap font family string length
  before persistence, but this is not a blocker because the value is only used as local renderer
  CSS.

Notes

• The default app font remains Geist.
• The setting is named IDE Font.
• The setting controls Orca’s app UI font only.
• Terminal font and editor/code font behavior remain unchanged.
• Visual smoke was performed with the IDE font set to Monocraft, confirming the app UI changed
  while terminal typography remained separate