feat(render+node-agent+admin): install fonts on all render nodes + verify

Push a font once → every node installs it → admin sees per-node status.

- render-svc: font_requests + node_fonts tables (mig 25); admin GET/POST/DELETE
  /v1/node-fonts (with per-node status matrix); internal (HMAC) GET pending +
  POST status for node-agents
- node-agent: fontSyncLoop polls pending fonts every 60s, downloads, installs
  (Windows Fonts dir + registry / macOS / linux fc-cache), reports Installed/Failed
- gateway: /v1/node-fonts/* → render
- admin /admin/node-fonts: upload a .ttf/.otf → install on all nodes; per-node
  Installed/Pending/Failed badges + counts + delete

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/db/migrations/25_render_node_fonts.sql

@@ -0,0 +1,28 @@
+-- =====================================================================
+-- RENDER SCHEMA — Part 25: font distribution to render nodes
+-- Admin requests a font to be installed on all nodes; each node-agent installs
+-- it and reports status, so the admin can verify per-node installation.
+-- =====================================================================
+
+SET search_path TO render, public;
+
+-- A font that should be present on every render node.
+CREATE TABLE IF NOT EXISTS font_requests (
+    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name        TEXT NOT NULL,
+    system_name TEXT,                 -- the OS/PostScript family name AE looks up
+    file_url    TEXT NOT NULL,        -- .ttf/.otf URL the node downloads
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- Per-node install status for a requested font.
+CREATE TABLE IF NOT EXISTS node_fonts (
+    node_id         UUID NOT NULL,
+    font_request_id UUID NOT NULL REFERENCES font_requests(id) ON DELETE CASCADE,
+    status          TEXT NOT NULL DEFAULT 'Pending',  -- Pending | Installed | Failed
+    error           TEXT,
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (node_id, font_request_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_node_fonts_request ON node_fonts (font_request_id);