Phase 5.8: Deliver verified Typefaces through FontFace

[danielmrdev]

What to build

Adapt the verified app-local Typeface pipeline to the webview. A writer can use System monospace or select one of five curated Typefaces, with verified bytes loaded through FontFace and writing always available offline.

Acceptance criteria

• Bundled iA Writer Quattro renders interface text from the first frame and retains its required licence notice.
• Rust remains solely responsible for pinned downloads, SHA-256 verification, cache validation, licence metadata, and retry.
• The frontend receives no network or arbitrary file capability and loads only bytes or URLs approved by the Typeface command boundary.
• A curated Typeface applies live only after verified FontFace loading succeeds; the current or System Typeface remains active otherwise.
• Settings shows downloading, active, failed, fallback, and retry states and exposes only verified real weights.
• System resolution and cross-platform fallback limitations are represented honestly and covered at the highest available seam.

Blocked by

• Phase 5.7: Apply persisted Appearance live #43

Workspace

• Mode: parallel lane
• Branch: feat/tauri-2-replatform-44
• Worktree: /home/daniel/Projects/lettera/.worktrees/feat-tauri-2-replatform-44
• Integrates into: feat/tauri-2-replatform
• Remote policy: local only — never push
• Completion: when unblocked, create the lane from the latest integration commit; validate it, merge it locally into integration with approval, validate integration, remove the lane worktree, and delete the local lane branch

[danielmrdev]

Frozen by the approved UI stack decision gate in #49. Do not implement this direct-migration ticket while the Floem/Tauri bake-off is open. Native dependency #54 records the live gate. After the blind decision, this ticket will be reviewed and respecified only if Tauri wins; if Floem wins, it will be closed as replaced.