fix(privacy): zero third-party requests from browser (v0.2.2)

- Remove Google Fonts links from web dashboard and testpage: opening
  the page no longer sends requests (IP/UA) to Google; system font
  stack renders identically, works offline and loads faster in CN
- Override default python-httpx User-Agent with a browser UA on all
  Xiaomi requests (matches cookie-based login origin, removes script
  fingerprint)
- PRIVACY.md: document zero-CDN frontend and minimal outbound headers

testpage/templates/index.html

@@ -5,9 +5,6 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Mi Fitness MCP | 健康数据中心与调试控制台</title>
   <link rel="stylesheet" href="/static/css/style.css">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
 </head>
 <body>
   <div id="app-container">