fix: add font-src CSP directive and styled error page

[tbjers]

Summary

• CSP regression from feat: themed dashboard redesign with 6-family light/dark theme picker #21: the themed redesign introduced @fontsource self-hosted fonts via @font-face declarations. Without an explicit font-src directive, browsers fall back to default-src — and even though the woff2 files are served from 'self', some browsers block them with the error "font-src was not explicitly set, so default-src is used as a fallback. The action has been blocked." Adding font-src 'self' to dashboard/static/_headers unblocks them.
• Bare error page: there was no +error.svelte, so any SvelteKit-level error (e.g. an API auth failure propagated through a load function) rendered on the browser's bare default error page — no layout, no padding, the status text touching the left edge. The new +error.svelte renders inside the root layout with the standard 24 px horizontal padding and uses the active theme's CSS tokens.

Root cause of the 401

The /api/projects 401 Unauthorized in the console is not caused by this PR or #21 — the auth middleware code is unchanged. It means the CF_Authorization cookie was absent or expired for that session. Re-authenticating through Cloudflare Access resolves it. The error page fix ensures that if it happens again the user sees a readable, on-brand message instead of the browser default.

Test plan

• Hard-reload the deployed dashboard — verify no font CSP violations in the console
• Verify Inter and JetBrains Mono render correctly in the header and cards
• Trigger an error state (e.g. open the detail page for a non-existent repo) — verify the error page shows with correct padding and theme colours
• Confirm npm run build still passes cleanly

🤖 Generated with Claude Code