fix: production hardening — bugs, perf, and offline support

[johnoct]

Summary

Comprehensive audit and fixes across the codebase for production readiness.

Bug fixes:

• Fix camera handle leak in try_open_camera — first VideoCapture was never released when falling back to AVFoundation
• Fix socket leak in get_local_ip — socket now properly closed via try/finally instead of only on success path
• Fix shell injection risk in send_notification — escape backslashes and double quotes in osascript strings

Performance optimizations:

• Cache CLAHE object at module level instead of recreating every frame (~10 allocations/sec saved)
• Lower JPEG stream quality from 95% to 75% — visually identical for baby monitor, ~2-3x bandwidth reduction
• Eliminate double apply_night_mode call when snapshots + night mode are both enabled (reuse display frame)
• Match MJPEG stream sleep interval to --fps setting instead of hardcoded 30fps polling

Production hardening:

• Remove Google Fonts dependency (Comfortaa, Nunito) for fully offline LAN operation
• Use system font stack (-apple-system, SF Pro) — no external network requests on page load

Test plan

• All 73 tests passing
• Manual: verify stream quality acceptable at 75% JPEG
• Manual: verify web UI fonts render correctly without Google Fonts
• Manual: verify camera reconnect cycle doesn't leak handles