security: remove PolinRider malware artifacts

[gitamiel]

PolinRider malware cleanup

Automatically generated by polinrider-remover. Every change below was confirmed by a known PolinRider signature. The scanner reads files as inert text and never executes them.

Removed / fixed

• .vscode: removed — Malicious .vscode configuration (tasks.json: executes a font/asset file as code (e.g. node ./public/fonts/…)) — removing the entire .vscode directory
• public/fonts: removed — Font carrier(s) found — removing the entire public/fonts directory (no recognizable font magic bytes; contains embedded code-like strings a real font never has (eval/require/global[/etc.))
• removed malware-injected entries from .gitignore and ensured .env patterns are ignored

⚠️ Also check the affected developer's machine for the initial dropper (a malicious npm global package or VS Code extension), and rotate any secrets that may have been exposed via committed .env files.