feat: expose theme preload links in /sites/_hashes

[BatLeDev]

Expose a preloadLinks list in GET /sites/_hashes so SPA consumers (@data-fair/lib serve-spa, the Nuxt portal) can emit <link rel="preload"> and fetch a site's resources in parallel with the theme stylesheet.

What changed:

• GET /sites/_hashes returns preloadLinks: [{ href, as?, type?, crossorigin? }] (renamed from fonts), taken straight from the theme's preloadLinks field (defined in @data-fair/lib, populated by the portals manager for custom fonts).
• simple-directory is a plain relay: it forwards the theme's preloadLinks verbatim (or the default theme's when the site sets none). No dedup, no per-resource logic, no {SITE_PATH} templating — the producer (portals + default theme) builds the complete, final list.
• config.ts drops the default Nunito link when the operator configures a custom body font via THEME_*.

Why: load a site's fonts (and tomorrow other resources like a logo) in parallel with the theme instead of waiting for _theme.css. Per review, SD does nothing but move the link list to where consumers need it.

Regression risks:

• _hashes field renamed fonts → preloadLinks; lib (feat: site resource preloads via theme schema and SPA injection lib#40, serve-spa) and portals (feat(portal): preload site fonts from sd _hashes portals#73) read the new key — deploy together.
• Requires the matching @data-fair/lib-common-types release (theme preloadLinks with explicit href / as / type / crossorigin).
• Dropped the previous per-slot fallback, dedup and {SITE_PATH} resolution — intentional; that logic now lives with the producer, and the default href is absolute now that sitePath is being deprecated.
• Bumps @data-fair/lib-express ^1.19→^1.23 (and lib-node ^2.12.1→^2.13.1) — that's how the preloadLinks theme field reaches this service. The bump also changes pseudo-session behavior: non-GET requests on a pseudo session now return 403 instead of 401 (lib-express session.js). pseudo-session.api.spec.ts's keepalive assertion was updated to match; any external consumer keying on 401 for that case will now see 403.