feat(render+node-agent+admin): install fonts on all render nodes + verify

Push a font once → every node installs it → admin sees per-node status.

- render-svc: font_requests + node_fonts tables (mig 25); admin GET/POST/DELETE
  /v1/node-fonts (with per-node status matrix); internal (HMAC) GET pending +
  POST status for node-agents
- node-agent: fontSyncLoop polls pending fonts every 60s, downloads, installs
  (Windows Fonts dir + registry / macOS / linux fc-cache), reports Installed/Failed
- gateway: /v1/node-fonts/* → render
- admin /admin/node-fonts: upload a .ttf/.otf → install on all nodes; per-node
  Installed/Pending/Failed badges + counts + delete

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/render/cmd/server/main.go

@@ -67,6 +67,7 @@ func main() {
 	snapH    := handlers.NewSnapshotHandler(store)
 	exportH  := handlers.NewExportHandler(store, mc, minioBucket)
 	nodeH    := handlers.NewNodeHandler(store)
+	fontH    := handlers.NewFontHandler(store)
 	internalH := handlers.NewInternalHandler(store, notifyClient, mc, minioTemplatesBucket, minioBucket)
 
 	// ── Router ────────────────────────────────────────────────────────────────
@@ -136,12 +137,22 @@ func main() {
 	v1.GET("/node-updates", auth, admin, nodeH.ListUpdates)
 	v1.POST("/node-updates/:update_id/rollout", auth, admin, nodeH.Rollout)
 
+	// ── Node fonts: install a font on all nodes + verify (admin) ──────────────
+	nodeFonts := v1.Group("/node-fonts", auth, admin)
+	{
+		nodeFonts.GET("", fontH.List)
+		nodeFonts.POST("", fontH.Create)
+		nodeFonts.DELETE("/:id", fontH.Delete)
+	}
+
 	// ── Internal (node agents only — HMAC auth) ───────────────────────────────
 	internal := v1.Group("/internal", nodeAuth)
 	{
 		internal.POST("/nodes/:node_id/heartbeat", internalH.Heartbeat)
 		internal.POST("/nodes/:node_id/online", internalH.Online)
 		internal.POST("/nodes/:node_id/cache-update", internalH.CacheUpdate)
+		internal.GET("/nodes/:node_id/fonts/pending", fontH.Pending)
+		internal.POST("/nodes/:node_id/fonts/:request_id/status", fontH.Report)
 		internal.POST("/render/jobs/claim", internalH.Claim)
 		internal.POST("/render/jobs/:job_id/preview", internalH.Preview)
 		internal.POST("/render/jobs/:job_id/output-upload-url", internalH.OutputUploadURL)