fix(audit): kill fake install cmds + dead demo CTA; production fonts; scoped error boundary; admin bootstrap seed

Full-site fake-data audit findings:
- SetupWizard showed a curl|sh installer (get.corrosionmgmt.com) and a
  'corrosion-agent' binary that don't exist -> real host-agent commands
- 'View live demo' CTA on 5 marketing pages linked to a login, not a
  demo -> honest 'Sign in'
- Google Fonts @import was silently dropped from the production CSS
  bundle (mid-bundle @import) -> <link> tags in index.html; prod was
  shipping system fallback fonts
- App-root ErrorBoundary bricked the entire SPA (incl. marketing) on a
  single failed fetch until manual reload -> resets on route change +
  content-scoped boundary inside DashboardLayout so nav chrome survives
- Status page KPIs showed fake zeros while the fetch failed -> em dash
- Login lacked the forgot-password link (flow already existed end-to-end)
- AdminSeedService: fresh DB had schema but no login possible; seeds
  super-admin + license from ADMIN_* env when users table is empty

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/styles/tokens/fonts.css

@@ -4,13 +4,14 @@
    JetBrains Mono — console, data, IDs, telemetry
    Oxanium   — brand wordmark + marketing display (game-ops flavor)
    ------------------------------------------------------------
-   NOTE: Loaded from Google Fonts CDN. If you want these self-
-   hosted (offline), send the woff2 files and these @imports
-   become @font-face rules.
+   NOTE: The Google Fonts stylesheet is loaded via <link> tags in
+   index.html — NOT @import here. A CSS @import that ends up
+   mid-bundle after concatenation is silently dropped by the
+   optimizer (fonts never load in production). If you want these
+   self-hosted (offline), send the woff2 files and they become
+   @font-face rules here.
    ============================================================ */
 
-@import url('https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600;700;800&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;0,700;1,400&family=Oxanium:wght@500;600;700;800&display=swap');
-
 :root {
   --font-sans: 'Geist', system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif;
   --font-mono: 'JetBrains Mono', ui-monospace, 'SF Mono', 'Cascadia Code', Menlo, monospace;