CLI: inline font download + checksum verification

- Add `fonts download` and `fonts verify` subcommands
- Implement Rust-based downloader (ureq + tar + flate2) with pinned sources
- Verify SHA-256 for Liberation and Noto Sans TTFs for reproducibility
- Keep binary behind `build-bin` feature; library build unaffected

Cargo.toml

@@ -65,6 +65,10 @@ tera = { version = "1.20", optional = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"
+ureq = { version = "2.10", features = ["tls"] }
+flate2 = { version = "1.0", features = ["rust_backend"] }
+tar = "0.4"
+sha2 = "0.10"
 
 # Error handling and logging
 anyhow = "1.0"