Add the design foundation: self-hosted Nunito, type scale, new tokens and an Icon component

docs/recht.md

@@ -24,6 +24,12 @@ Google Fonts, Maps, YouTube embeds, and CDN scripts transmit visitors' IPs to th
 parties. Fonts are served by ourselves. This is the reason behind the "no external
 resources" rule in `CLAUDE.md` — data protection, not taste.
 
+The site font is Nunito (SIL Open Font License 1.1), self-hosted under
+`wwwroot/fonts/` with its license file `OFL.txt` next to it, as the OFL requires.
+The icons are Lucide (ISC, partly MIT via Feather), inlined as SVG in
+`Shared/IconSet.cs` with the license notice in its comment. A smoke test fails if
+the stylesheet or the home page loads anything from an absolute URL.
+
 ## Photos of children
 
 Only with the consent of the legal guardians — by far the most common mistake on