fix(login): load custom font from branding settings and allow in CSP (#12279)

Closes #11200

# Which Problems Are Solved

Custom fonts uploaded via the branding/label policy were not supported.

# How the Problems Are Solved

- The login now correctly applies the branding settings, based on the
organization context
- Use the absolute `fontUrl` from the branding API directly in the
`@font-face` `src`, matching how logo and icon assets are already loaded
via absolute URLs.
- Add the Zitadel service URL to the `font-src` CSP directive so the
browser permits loading the cross-origin font.

# Additional Changes

- Updated CSP tests to reflect the new `font-src` behavior.

apps/login/src/lib/csp.test.ts

@@ -15,11 +15,11 @@ describe("buildCSP", () => {
     expect(csp).toContain("frame-ancestors 'none'");
   });
 
-  test("adds serviceUrl to img-src only", () => {
+  test("adds serviceUrl to img-src and font-src", () => {
     const csp = buildCSP({ serviceUrl: "https://my-instance.zitadel.cloud" });
 
     expect(csp).toContain("img-src 'self' https://my-instance.zitadel.cloud");
-    expect(csp).toMatch(/font-src 'self'(?:;| |$)/);
+    expect(csp).toContain("font-src 'self' https://my-instance.zitadel.cloud");
   });
 
   test("keeps frame-ancestors as 'none' when iframeOrigins is empty", () => {
@@ -44,6 +44,7 @@ describe("buildCSP", () => {
     });
 
     expect(csp).toContain("img-src 'self' https://zitadel.mycompany.com");
+    expect(csp).toContain("font-src 'self' https://zitadel.mycompany.com");
     expect(csp).toContain("frame-ancestors https://portal.mycompany.com");
     expect(csp).not.toContain("frame-ancestors 'none'");
   });

apps/login/src/lib/csp.ts

@@ -19,6 +19,7 @@ export function buildCSP(options: CSPOptions = {}): string {
 
   if (options.serviceUrl) {
     directives["img-src"] = [...directives["img-src"], options.serviceUrl];
+    directives["font-src"] = [...directives["font-src"], options.serviceUrl];
   }
 
   if (options.iframeOrigins && options.iframeOrigins.length > 0) {