/* Paxiom — body face is DM Sans, served via the Google Fonts CDN.
*
* The @font-face rules live on Google's CSS endpoint
* (https://fonts.googleapis.com/css2?family=DM+Sans:...&display=swap)
* and are loaded by the tag in every page's .
* This file stays as a stable href so a future swap to self-hosting only
* has to update one location.
*
* DM Sans is licensed under the SIL Open Font License (OFL). See
* fonts/README.md for the licence audit trail and the rationale for
* choosing it over the earlier commercial faces.
*
* If/when self-hosting becomes preferable (perf, privacy, no third-party
* CDN), drop the .woff2 files into /fonts/ and replace this file's
* @font-face section with rules pointing at them. The font-family name
* stays 'DM Sans' so no page changes needed.
*/
/* Audit L-7: shared design tokens.
*
* These 9 vars are identical across every public page. Pages that need
* additional tokens (--rule, --blue-light, --green, --grid, --redacted)
* declare them in their inline