feat(render+node-agent+admin): install fonts on all render nodes + verify

Push a font once → every node installs it → admin sees per-node status.

- render-svc: font_requests + node_fonts tables (mig 25); admin GET/POST/DELETE
  /v1/node-fonts (with per-node status matrix); internal (HMAC) GET pending +
  POST status for node-agents
- node-agent: fontSyncLoop polls pending fonts every 60s, downloads, installs
  (Windows Fonts dir + registry / macOS / linux fc-cache), reports Installed/Failed
- gateway: /v1/node-fonts/* → render
- admin /admin/node-fonts: upload a .ttf/.otf → install on all nodes; per-node
  Installed/Pending/Failed badges + counts + delete

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/render/internal/models/fonts.go

@@ -0,0 +1,49 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type FontRequest struct {
+	ID         uuid.UUID `json:"id"`
+	Name       string    `json:"name"`
+	SystemName *string   `json:"system_name,omitempty"`
+	FileURL    string    `json:"file_url"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+type NodeFontStatus struct {
+	NodeID    uuid.UUID  `json:"node_id"`
+	NodeName  string     `json:"node_name"`
+	Status    string     `json:"status"` // Pending | Installed | Failed
+	Error     *string    `json:"error,omitempty"`
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+}
+
+type FontRequestWithStatus struct {
+	FontRequest
+	InstalledCount int              `json:"installed_count"`
+	TotalNodes     int              `json:"total_nodes"`
+	Nodes          []NodeFontStatus `json:"nodes"`
+}
+
+type CreateFontRequestBody struct {
+	Name       string `json:"name"        binding:"required"`
+	SystemName string `json:"system_name"`
+	FileURL    string `json:"file_url"    binding:"required"`
+}
+
+// Sent to node-agents.
+type PendingFont struct {
+	ID         uuid.UUID `json:"id"`
+	Name       string    `json:"name"`
+	SystemName *string   `json:"system_name,omitempty"`
+	FileURL    string    `json:"file_url"`
+}
+
+type FontStatusReport struct {
+	Status string `json:"status"` // Installed | Failed
+	Error  string `json:"error"`
+}