fix(fonts): 함초롬체 loads from a public CDN — offline rendering falls back and requests leak

[amondnet]

Problem

rhwp-studio/src/core/font-loader.ts maps the entire 함초롬/한컴 family to woff files on cdn.jsdelivr.net:

// 함초롬체 CDN (눈누 jsdelivr — 비상업적 사용 허용, 한컴 라이선스)
const CDN_HAMCHOB_R = 'https://cdn.jsdelivr.net/gh/projectnoonnu/noonfonts_2104@1.0/HANBatang.woff';
const CDN_HAMCHOB_B = 'https://cdn.jsdelivr.net/gh/projectnoonnu/noonfonts_2104@1.0/HANBatangB.woff';
const CDN_HAMCHOD_R = 'https://cdn.jsdelivr.net/gh/projectnoonnu/noonfonts_four@1.0/HCRDotum.woff';

Nine font names route there — 함초롬돋움, 함초롬바탕, 함초롱돋움, 함초롱바탕, 한컴돋움, 한컴바탕, 한컴산뜻돋움, 새돋움, 새바탕 — and those are the defaults in most real HWP documents. Every other mapping in that file resolves to a local fonts/*.woff2; 36 font files ship in apps/studio-host/dist/fonts/. This family is the only remote one, and cdn.jsdelivr.net is the only external origin in the built bundle.

Upstream already provides the lever: WebFontLoadOptions.disableExternalWebFonts (font-loader.ts:20), surfaced as a setting in core/extension-settings.ts. It defaults to false, and rhwp-studio/src/main.ts:97 passes false explicitly — so OpenHWP currently ships with CDN fetching on.

Impact

1. Offline behavior is not what the project implies. The engine, the studio, and the substitute fonts are all local, but opening a typical .hwp still fires requests to jsdelivr. With no network the 함초롬 family silently falls back, so the document renders in the wrong typeface — on the most common font in the format.
2. A desktop editor makes an unannounced third-party request on document load. That is a privacy surface users of an offline app would not expect, and it sits awkwardly next to the strict-CSP posture from 001d834.

Why this is not simply "vendor the fonts"

The source comment records the licence: 눈누 jsdelivr, 비상업적 사용 허용, 한컴 라이선스 — Hancom's licence, non-commercial use only. Copying those woff files into this MIT repo and redistributing them inside signed installers is not obviously permitted, so vendoring needs a licence decision rather than a quick copy.

Options

1. Set disableExternalWebFonts: true through a studio override tracked in config/rhwp-studio-overrides.json. No network calls; 함초롬 falls back to bundled substitutes. Smallest change and honest offline behavior, at the cost of fidelity on the most common font.
2. Add a local substitute mapping for the 함초롬 family pointing at an openly licensed Korean serif/sans already present in dist/fonts/, rather than leaving a bare fallback. Better fidelity than option 1 and still fully local.
3. Use the user's installed Hancom fonts via the existing local-fonts path (ui/local-fonts-modal.ts), keeping the CDN only as an explicit, opt-in fallback.

Notes

Found while rewriting the README architecture section. The README wording has been corrected to describe the current behavior rather than the intended one, so this issue tracks the behavior itself.