fix: vendor dashboard fonts + vault_exec docs cleanup

- Geist/Geist Mono via @fontsource inside the Vite bundle — the
  Google Fonts <link> was blocked by the nginx CSP (style-src 'self'),
  so the dashboard silently fell back and phoned home on self-hosted
  instances. Fonts now serve from /assets under 'self' — CSP-clean,
  airgapped, no console violation.
- mcp README: vault_exec described the old deny-list; rewritten for
  the allow-list contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/frontend/index.html

@@ -16,13 +16,6 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <meta name="apple-mobile-web-app-title" content="Primora" />
 
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500&display=swap"
-      rel="stylesheet"
-    />
-
     <style>
       html { background: #0a0a0b; color-scheme: dark; }
       html.light { background: #fafaf9; color-scheme: light; }

apps/frontend/package.json

@@ -10,6 +10,8 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@fontsource/geist": "^5.3.0",
+    "@fontsource/geist-mono": "^5.3.0",
     "@primora/api-client": "0.5.0",
     "@primora/shared-types": "0.5.0",
     "better-auth": "^1.5.6",

apps/frontend/src/index.css

@@ -5,6 +5,15 @@
    hairlines, tabular numerals, no decoration.
    ============================================================ */
 
+/* Vendored via @fontsource — self-hosted, no runtime Google dependency
+   (the nginx CSP only allows 'self'). */
+@import "@fontsource/geist/400.css";
+@import "@fontsource/geist/500.css";
+@import "@fontsource/geist/600.css";
+@import "@fontsource/geist/700.css";
+@import "@fontsource/geist-mono/400.css";
+@import "@fontsource/geist-mono/500.css";
+
 @tailwind base;
 @tailwind components;
 @tailwind utilities;

apps/mcp/README.md

@@ -27,8 +27,12 @@ Secrets are agent-safe by design — values are never returned by any tool:
 - `primora_vault_status` / `primora_vault_list` — local-vault state and
   metadata (names/urls/notes only); requires `primora vault unlock` on the host.
 - `primora_vault_exec` — runs `primora` commands with a vault secret injected
-  into the child's env; `vault`/`secrets`/`inject`/`agent`/`login`/`use` and
-  `keys:create` are denied so no response can carry a credential.
+  into the child's env. A strict allow-list (read-mostly commands like
+  `whoami`, `context`, `orgs:list`, `buckets:list`, `jobs:list`,
+  `audit:list`, `events:send`) — nothing that reads, writes, or moves a
+  credential can run; file/path flags are rejected and the injected env
+  name must be a safe identifier (loader hooks like `NODE_OPTIONS` are
+  blocked).
 - `primora_secrets_list` / `primora_secrets_set` — project-vault metadata and
   write-only storage. No reveal or delete: agents consume secrets through
   `secret://NAME` references in job payloads, resolved server-side at delivery.