/* Self-hosted, licensed faces reused from ProDAQ's bundle (prodaq-fonts/). NO CDN — not a
   preference: this server is internet-facing because customer sites must reach /verify, so every
   external origin is one more piece of attack surface and one more CSP exception.

   Archivo carries the interface. IBM Plex Mono carries the DATA — every machine id, key,
   fingerprint and date — because a machine id is 32 hex characters a human compares against an
   email character by character, and a proportional face makes that materially harder.

   font-display: swap throughout: text renders immediately in the fallback and reflows when the face
   arrives. On a login page that is the difference between a blank card and a usable form. */

@font-face {
  font-family: 'Archivo';
  font-style: normal;
  font-weight: 400;
  font-display: swap;
  src: url('/fonts/archivo-latin-400-normal.woff2') format('woff2');
}
@font-face {
  font-family: 'Archivo';
  font-style: normal;
  font-weight: 500;
  font-display: swap;
  src: url('/fonts/archivo-latin-500-normal.woff2') format('woff2');
}
@font-face {
  font-family: 'Archivo';
  font-style: normal;
  font-weight: 600;
  font-display: swap;
  src: url('/fonts/archivo-latin-600-normal.woff2') format('woff2');
}
@font-face {
  font-family: 'Archivo';
  font-style: normal;
  font-weight: 700;
  font-display: swap;
  src: url('/fonts/archivo-latin-700-normal.woff2') format('woff2');
}
@font-face {
  font-family: 'IBM Plex Mono';
  font-style: normal;
  font-weight: 400;
  font-display: swap;
  src: url('/fonts/ibm-plex-mono-latin-400-normal.woff2') format('woff2');
}
@font-face {
  font-family: 'IBM Plex Mono';
  font-style: normal;
  font-weight: 500;
  font-display: swap;
  src: url('/fonts/ibm-plex-mono-latin-500-normal.woff2') format('woff2');
}