fix(wp): match local font file names to the sanitized upload name

[DavidBabinec]

Fixes #24

The bug

Local fonts whose family name has a space (for example Source Sans 3) never load on the front end. WordPress stores the upload under a sanitized name, where spaces become dashes, but the @font-face src was built from the raw family and kept the spaces. It pointed at a file that 404s, and the browser dropped the font silently. Reported by a customer on 2.0.1.

The fix

The upload file name and the CSS src now come from one helper, localFontFileName, which sanitizes the name the way sanitize_file_name() does, so the URL always matches the file on disk. Font deletion uses it too. The helper lives in core with unit coverage. The www app is unaffected: it references the real file URLs, not a constructed path. Existing broken fonts need one re-save to regenerate their CSS.

Verification

bun run test:www          # 156 pass, 0 fail (new sanitizeFontFileName suite)
bun run build:wp          # clean
bun run check:open-source # clean

Notes

The importer also downloads the same variable font once per weight (byte identical). Left as a follow-up.