fix: vendor dashboard fonts + vault_exec docs cleanup

- Geist/Geist Mono via @fontsource inside the Vite bundle — the
  Google Fonts <link> was blocked by the nginx CSP (style-src 'self'),
  so the dashboard silently fell back and phoned home on self-hosted
  instances. Fonts now serve from /assets under 'self' — CSP-clean,
  airgapped, no console violation.
- mcp README: vault_exec described the old deny-list; rewritten for
  the allow-list contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

package-lock.json

@@ -38,7 +38,7 @@
     },
     "apps/cli": {
       "name": "@primora/cli",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "dependencies": {
         "@clack/prompts": "^1.8.1",
         "@noble/ciphers": "^2.4.0",
@@ -78,6 +78,8 @@
       "name": "@primora/frontend",
       "version": "0.5.0",
       "dependencies": {
+        "@fontsource/geist": "^5.3.0",
+        "@fontsource/geist-mono": "^5.3.0",
         "@primora/api-client": "0.5.0",
         "@primora/shared-types": "0.5.0",
         "better-auth": "^1.5.6",
@@ -2341,6 +2343,24 @@
         "node": ">=18"
       }
     },
+    "node_modules/@fontsource/geist": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource/geist/-/geist-5.3.0.tgz",
+      "integrity": "sha512-u03ftlfVwb05uijq2jGDJ03/HKGqMKaNFk7KOhkpBUex8+BhrAOfMs/XciJ2UUNUX9fEsZbZQld/RWMA2oFU7g==",
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
+    "node_modules/@fontsource/geist-mono": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@fontsource/geist-mono/-/geist-mono-5.3.0.tgz",
+      "integrity": "sha512-UtJ1BBBCVpMYdIcW7nEB45UAoAw5M53ZXs2t0ciPW+IokuAAIc56M8+kW5tXbRJCTpDw4XTtU7proT6NdQAHTg==",
+      "license": "OFL-1.1",
+      "funding": {
+        "url": "https://github.com/sponsors/ayuhito"
+      }
+    },
     "node_modules/@hono/node-server": {
       "version": "1.19.11",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.11.tgz",