UI fix

internal/dashboard/static/vendor/VENDOR.md

@@ -9,18 +9,33 @@ commit, if a newer version is actually needed.
 |---|---|---|---|
 | `htmx.min.js` | https://unpkg.com/htmx.org@2.0.10/dist/htmx.min.js | 2.0.10 | 2026-08-23 |
 | `alpine.min.js` | https://unpkg.com/alpinejs@3.16.2/dist/cdn.min.js | 3.16.2 | 2026-08-23 |
-| `bootstrap.min.css` | https://unpkg.com/bootstrap@5.3.8/dist/css/bootstrap.min.css | 5.3.8 | 2026-08-23 |
+| `fonts.css` + `fonts/*.woff2` | Google Fonts CSS2 API (`family=Manrope:wght@500;600;700;800\|family=IBM+Plex+Mono:wght@400;500`) | Manrope v20, IBM Plex Mono v20 | 2026-08-23 |
 
-Only Bootstrap's CSS is vendored — no `bootstrap.bundle.min.js`/Popper: the
-dashboard doesn't use any Bootstrap component that requires JS (navbar
-collapse, dropdowns, modals, tooltips). Confirmations use the browser's
-native dialog via htmx's `hx-confirm`, not a Bootstrap modal. If a future
-page genuinely needs Bootstrap JS, vendor `bootstrap.bundle.min.js`
-alongside this file rather than pulling it from a CDN.
+## Fonts
 
-Previously used Pico CSS (classless build) — replaced by Bootstrap 5 for a
-more compact, conventional admin-dashboard look (denser tables/forms via
-`table-sm`/`*-sm` utilities) per explicit request.
+The dashboard's design system (`../dashboard.css`) uses **Manrope**
+(UI chrome/headings — a variable font, so one file per subset covers all
+four vendored weights) and **IBM Plex Mono** (tabular data: IP addresses,
+timestamps, ports — one file per weight per subset). Only the `latin`,
+`latin-ext`, `cyrillic`, and `cyrillic-ext` subsets are vendored (the UI
+is Russian/English only) — `greek` and `vietnamese` from the upstream CSS
+were dropped. `fonts.css` was hand-rewritten from the fetched Google Fonts
+CSS to point at the local `fonts/*.woff2` files instead of
+`fonts.gstatic.com`, keeping the original `unicode-range` subsetting so
+browsers still only fetch the subset(s) actually used.
 
-Licenses: htmx (BSD 2-Clause), Alpine.js (MIT), Bootstrap (MIT) — all
-permit vendoring/redistribution unmodified.
+No CSS framework is vendored: the design system in `dashboard.css` is
+hand-written (sidebar shell, panels, tables, pills, forms, buttons,
+alerts) rather than built on Bootstrap/Pico/etc — see
+`docs/PLAN_ADMIN_DASHBOARD.md` for why (a framework's default look kept
+fighting the "modern, compact, rounded" brief; a small hand-rolled system
+gave full control for less code than fighting one).
+
+Only htmx's and Alpine's CSS-adjacent-nothing JS is vendored — no
+`bootstrap.bundle.min.js`/Popper equivalent is needed since the dashboard
+doesn't use any component that requires JS beyond htmx/Alpine themselves
+(the mobile sidebar toggle is a pure-CSS checkbox trick, not JS;
+confirmations use the browser's native dialog via htmx's `hx-confirm`).
+
+Licenses: htmx (BSD 2-Clause), Alpine.js (MIT), Manrope (OFL-1.1), IBM Plex
+Mono (OFL-1.1) — all permit vendoring/redistribution unmodified.