feat(web): self-host Japanese font and load on-demand without external CDN

- Bundle BIZ UDPGothic Regular (SIL OFL 1.1) exclusively in solvecraft-web dist

- Remove external jsDelivr CDN fallback; fetch font solely from same-origin ./fonts/

- Fetch Japanese font on-demand only when UI language is set to Japanese

- Gracefully fall back to English UI on fetch failure to prevent tofu glyphs

- Update ATTRIBUTION.md, NOTICE, and THIRD-PARTY-LICENSES.txt

docs/localization.md

@@ -31,11 +31,16 @@ Standalone translated panels enter the same scope. Measure rendered text to size
 widgets; UTF-8 byte lengths do not describe their displayed width.
 
 The desktop host tries system CJK fonts across Windows, macOS and Linux, as well as an optional
-`CRAFT_FONTS_DIR` font pack, and skips files that cannot be parsed. No system fonts are redistributed.
-Japanese glyph coverage on desktop depends on installed system fonts or craft-fonts. In the browser,
-`solvecraft-web` asynchronously loads a licensed CJK font (trying self-hosted `./fonts/` first, then
-falling back to a public CDN) and installs it into egui once fetched so that localized text renders
-seamlessly without requiring local system font access.
+`CRAFT_FONTS_DIR` font pack, and skips files that cannot be parsed. No fonts are redistributed
+in native desktop distribution packages; native builds rely entirely on existing operating system fonts
+or craft-fonts.
+
+In the browser, `solvecraft-web` bundles a self-hosted Japanese font (`BIZUDPGothic-Regular.ttf`, licensed
+under SIL OFL 1.1) within the web distribution artifacts only. The font is loaded asynchronously from the same
+origin (`./fonts/BIZUDPGothic-Regular.ttf`) on-demand when the interface language is set to Japanese, without
+contacting any external CDNs or third-party servers. For users with an English interface, no font download
+occurs. If font loading fails, the web interface gracefully falls back to English to prevent missing glyphs
+(tofu). This bundled font specifically targets Japanese; Korean (Hangul) and Chinese scripts are not covered.
 
 The current messages support named substitution, not locale-specific plural selection,
 number/date formatting, or right-to-left layout and shaping. Add those capabilities when