These fonts apply to markdown headings (h1-h6), so "heading" is more
accurate than "title". Renames the chosen*Font field, store action, and
the --heading-font-family CSS variable.
Keeps backward compatibility: .remanso.json still honors the legacy `t`
key (alongside the new `h`), and a saved `chosenTitleFont` in
localStorage is migrated on load so existing preferences survive.
Resolves conflict in repo.spec.ts by combining getRepoPermission
tests from main with the getFiles and queryFileContent tests from
the local test pass. Adds getRepoPermission to the userRepo.store
spec mocks so the new permission probe added upstream doesn't break
the store tests.
Fetch the viewer's push permission via GET /repos/{owner}/{repo} when
entering a repo and gate every write affordance behind it: edit and
image-upload buttons in StackedNote, new-fleeting-note and YouTube
buttons in FleetingNotes, and interactive checkboxes in TodoNotes
(rendered disabled when read-only). Anonymous viewers get the same
treatment because the permissions field is absent without auth, which
collapses to canPush = false.
Previously every write button was visible regardless of role, so
read-role collaborators and anonymous viewers could enter edit mode and
type before the save failed with 401/403.
