vendor preact, htm and the two webfonts: nothing is fetched from anyone else

app/state.js imported preact and htm from esm.sh at runtime, and five pages linked fonts.googleapis.com. Three consequences, one of them serious:

• The PWA could not boot offline. sw.js passes cross-origin through and never caches it, so the service worker could hold the entire app and all its media and the instrument still would not start without a live…

• The page is COEP require-corp and neither host sends Cross-Origin-Resource- Policy, which is what Safari was reporting -- and it means Orbitron and VT323 were very likely not rendering in production at all.

• And a third party saw a request from every visitor, which undercuts the "no accounts, no cookies, no data" posture the security.txt advertises.

• vendor/preact, vendor/htm and vendor/fonts follow the pattern the other five vendored libraries already use: exact version, upstream LICENSE, a VERSION.txt saying why.

▶ Play it: Neon Fiscal Year — the embeddable player, in someone else's page https://stellate.app/embed.html?genre=citypop&seed=9259&path=1530.6199,1549.6232,1511.6232&xdur=13.122

de6c9de https://github.com/aboard-io/stellate/commit/de6c9de38b9f724897993cb5bfee377d3107915a