feat: SEO crawlability + on-brand copy

Make every served byte crawlable without executing JS, remove off-brand
copy, and cut third-party requests.

- Copy: replace off-brand terms (survival/crisis/collapse) in title, meta,
  OG/Twitter, JSON-LD and webmanifest with on-brand preparedness copy.
  Update App.vue i18n page_title/meta_description (EN+DE) too, since the app
  overwrites the head at runtime. Reconcile area count to the real 6.
- Prerender: vite-plugin-seo-snapshot injects a static <noscript> snapshot
  (real <h1>, content, <a href>) after #app. JS users ignore <noscript>, so
  the live app/UX is unchanged; curl/no-JS crawlers get real content.
- 404: nginx now returns true 404s on unknown paths (no soft-200 SPA
  fallback) with a branded 404 page.
- Sitemap: drop no-op hreflang alternates, add <lastmod>.
- Fonts: self-host Space Mono / DM Serif Display / Barlow (woff2, latin +
  latin-ext, font-display: swap); preload above-the-fold faces. No more
  fonts.googleapis/gstatic requests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nginx.conf

@@ -24,10 +24,25 @@ server {
     try_files $uri =404;
   }
 
-  # SPA fallback — any non-asset path serves index.html so future
-  # client-side routing works without 404s.
+  # App shell — only the root path serves index.html. The app is a
+  # single-route SPA (no history-based client routing), so there is no
+  # need to fall back unknown paths to index.html.
+  location = / {
+    try_files /index.html =404;
+  }
+
+  # Everything else serves a real file if it exists, otherwise a true 404.
+  # This avoids the soft-404 (HTTP 200 on unknown paths) that hurts SEO.
+  # When real redirects/removals appear, add `return 301`/`return 410`
+  # location blocks above this one.
   location / {
-    try_files $uri $uri/ /index.html;
+    try_files $uri $uri/ =404;
+  }
+
+  # Branded 404 page (shipped from public/404.html).
+  error_page 404 /404.html;
+  location = /404.html {
+    internal;
   }
 
   # Don't serve dotfiles