Font family options in settings

[bendsp]

Add a font-family setting to Bedrock so users can choose from a small curated set of built-in font options.

Intent

Users should be able to change the app/editor font from Settings instead of being locked to the current default stack. The built-in list must include Satoshi.

Scope

• Add a font family setting in Settings.
• Provide a curated list of built-in options rather than arbitrary custom font entry.
• Ensure Satoshi is one of the available choices.
• Preserve the current single-window app model and existing theme/text-size behavior.

Functional requirements

• Add a persisted font family preference alongside the existing settings model.
• Expose the setting in the Settings UI near the existing text-size and appearance controls.
• Apply the selected font consistently to the primary editing experience.
• Keep code-oriented inline formatting (code, fenced code, other monospace treatments) on a monospace stack unless there is a deliberate reason to change them.
• Include enough built-in options to feel meaningfully different, not just a single alternative.
• Handle missing fonts gracefully by falling back to a sensible stack.

Public interfaces

• Extend the shared/persisted settings shape with a font family choice.
• Add any renderer/theme plumbing needed to apply the chosen font without breaking existing theme switching.

Acceptance criteria

• Settings contains a font-family option.
• Font choice persists across app restarts.
• Switching fonts updates the editor/app without requiring a restart.
• Satoshi is present in the available options.
• If the chosen font is unavailable on the machine, Bedrock falls back cleanly instead of rendering broken text.
• Existing text-size, theme, and markdown editing behavior continue to work.

Test plan

• Unit coverage for settings load/save/default behavior for the new font preference.
• Manual QA for changing fonts, persisting the choice, and validating fallback behavior on a machine without the selected font.
• Manual QA to confirm code spans / code blocks remain readable and appropriate after font changes.

Out of scope

• Arbitrary custom font file import
• Per-surface font customization unless it falls out naturally from implementation
• Downloading fonts at runtime