fix(privacy): zero third-party requests from browser (v0.2.2)

- Remove Google Fonts links from web dashboard and testpage: opening
  the page no longer sends requests (IP/UA) to Google; system font
  stack renders identically, works offline and loads faster in CN
- Override default python-httpx User-Agent with a browser UA on all
  Xiaomi requests (matches cookie-based login origin, removes script
  fingerprint)
- PRIVACY.md: document zero-CDN frontend and minimal outbound headers

src/mi_fitness_mcp/adapters/mi_fitness_cloud.py

@@ -130,7 +130,17 @@ class MiFitnessCloudAdapter(DataAdapter):
                 self._connected = False
                 return False
             await self._close_client()
-            self._client = httpx.AsyncClient(timeout=self.http_timeout, follow_redirects=False)
+            self._client = httpx.AsyncClient(
+                timeout=self.http_timeout,
+                follow_redirects=False,
+                # 浏览器 UA 与 Cookie 登录来源一致，避免暴露 python-httpx 指纹
+                headers={
+                    "User-Agent": (
+                        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
+                        "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+                    )
+                },
+            )
             try:
                 await self._login_with_token(self.user_id, self.pass_token)
                 # Trust an explicitly configured region. Expensive cross-region discovery

src/mi_fitness_mcp/api.py

@@ -184,7 +184,7 @@ async def _gate(x_api_key: str | None = Header(default=None)) -> None:
 
 app = FastAPI(
     title="Mi Fitness API",
-    version="0.2.1",
+    version="0.2.2",
     description="小米运动健康数据 REST API（多 Key 鉴权 + 扫码登录 + 本地 SQLite 缓存）",
     lifespan=lifespan,
     dependencies=[Depends(_gate)],

src/mi_fitness_mcp/web_assets/templates/index.html

@@ -5,9 +5,6 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Mi Fitness MCP | 健康数据中心与调试控制台</title>
   <link rel="stylesheet" href="/static/css/style.css">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
 </head>
 <body>
   <div id="app-container">