feat(render+node-agent+admin): install fonts on all render nodes + verify

Push a font once → every node installs it → admin sees per-node status.

- render-svc: font_requests + node_fonts tables (mig 25); admin GET/POST/DELETE
  /v1/node-fonts (with per-node status matrix); internal (HMAC) GET pending +
  POST status for node-agents
- node-agent: fontSyncLoop polls pending fonts every 60s, downloads, installs
  (Windows Fonts dir + registry / macOS / linux fc-cache), reports Installed/Failed
- gateway: /v1/node-fonts/* → render
- admin /admin/node-fonts: upload a .ttf/.otf → install on all nodes; per-node
  Installed/Pending/Failed badges + counts + delete

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/node-agent/cmd/agent/main.go

@@ -121,9 +121,10 @@ func main() {
 
 	// Main loops
 	var wg sync.WaitGroup
-	wg.Add(2)
+	wg.Add(3)
 	go func() { defer wg.Done(); agent.heartbeatLoop(ctx) }()
 	go func() { defer wg.Done(); agent.pollLoop(ctx) }()
+	go func() { defer wg.Done(); agent.fontSyncLoop(ctx) }()
 	wg.Wait()
 	log.Printf("shutdown complete")
 }
@@ -144,6 +145,44 @@ func (a *Agent) registerOnline(ctx context.Context) error {
 	return nil
 }
 
+// ── Font sync loop ────────────────────────────────────────────────────────────
+// Periodically installs any fonts the orchestrator wants on this node and reports
+// per-font status, so the admin can verify installation.
+
+func (a *Agent) fontSyncLoop(ctx context.Context) {
+	ticker := time.NewTicker(60 * time.Second)
+	defer ticker.Stop()
+	a.syncFonts(ctx) // run once on startup
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			a.syncFonts(ctx)
+		}
+	}
+}
+
+func (a *Agent) syncFonts(ctx context.Context) {
+	fonts, err := a.orch.PendingFonts(ctx, a.cfg.NodeID)
+	if err != nil {
+		return // transient; try again next tick
+	}
+	for _, f := range fonts {
+		name := f.SystemName
+		if name == "" {
+			name = f.Name
+		}
+		if err := runner.InstallFont(ctx, f.FileURL, name); err != nil {
+			log.Printf("font install failed (%s): %v", f.Name, err)
+			_ = a.orch.ReportFont(ctx, a.cfg.NodeID, f.ID, "Failed", err.Error())
+			continue
+		}
+		log.Printf("font installed: %s", f.Name)
+		_ = a.orch.ReportFont(ctx, a.cfg.NodeID, f.ID, "Installed", "")
+	}
+}
+
 // ── Heartbeat loop ────────────────────────────────────────────────────────────
 
 func (a *Agent) heartbeatLoop(ctx context.Context) {