v46.1-ui-mt76: Argon theme + hardened WG tunnel + Link Health dashboard

基于 v46 正式版(mt76)只恢复 UI 层:
- luci-theme-argon 2.4.3: local-background-wins 登录页 + bg1.jpg fallback
- luci-app-argon-config: 去 ui.changes.apply, ACL mutator 移 write
- luci-app-wgtunnel: rpcd ucode 后端(get/status/prepare/apply/rollback/reconnect),
  JSONMap 前端, 60s 一次性 token, 快照回滚, 无全局 network ACL
- luci-app-tr3000-status: 只读 rpcd ucode + 5s 轮询仪表盘
- tools/: audit_ui_packages.py + install_preview.sh + rollback_watchdog.sh
- docs/: 开发经历与翻车记录 + 固件哈希记录

固件本体(含烤入 WG 私钥/PSK)不入 git, 仅 K 盘保存.
kernel 成员与 v46 byte-identical; 尚未刷机.

immortalwrt-patches/feeds/luci/themes/luci-theme-argon/less/fonts.less

@@ -0,0 +1,38 @@
+// out: false 
+
+// ==========================================================================
+// CSS Custom Properties for Font Management
+// ==========================================================================
+
+@font-face {
+    font-family: 'Google Sans';
+    src: local('Google Sans'),
+        local('GoogleSans-Regular'),
+        url('../fonts/GoogleSans-Regular.woff2') format('woff2'),
+        url('../fonts/GoogleSans-Regular.woff') format('woff');
+    font-weight: normal;
+    font-style: normal;
+    font-display: swap;
+}
+
+/*  Logo Font */
+@font-face {
+    font-family: 'TypoGraphica';
+    src: local('TypoGraphica'),
+        url('../fonts/TypoGraphica.woff2') format('woff2'),
+        url('../fonts/TypoGraphica.woff') format('woff');
+    font-weight: normal;
+    font-style: normal;
+    font-display: swap;
+}
+
+/* Icon Font */
+@font-face {
+    font-family: 'argon';
+    src: url('../fonts/argon.woff2') format('woff2'),
+        url('../fonts/argon.woff') format('woff');
+    font-weight: normal;
+    font-style: normal;
+    font-display: swap;
+}
+