LabelledCheckbox, self-hosted fonts, and automated NixOS plugin pins

[felixevers]

Summary

Three related improvements: UI fixes on the login/account theme, the missing font files, and an automated release→docs pinning pipeline for NixOS deployments. Bumps the version to 0.6.1 so merging cuts a release that exercises the new pipeline end-to-end.

1. LabelledCheckbox instead of a separate checkbox + label

The Register, Login and Terms pages built the terms/remember-me checkbox out of a separate Checkbox plus a hand-rolled clickable <label> (with its own role/tabIndex/keydown wiring). These are replaced with hightide's LabelledCheckbox, which already handles container-click toggling, keyboard toggling and accessible label association. The terms link stays a real <a> and keeps stopPropagation() so clicking it opens the terms without toggling the checkbox.

Spacing: on Register and Login the checkbox previously sat ~2rem below the form fields but only ~1rem above the action buttons, so it visually attached to the buttons. It now sits ~1rem below the fields and ~1.5rem above the buttons, grouping it with the form.

2. Self-hosted fonts (Inter & Space Grotesk)

The app referenced the Inter / Space Grotesk families by name (via hightide's typography utilities) but never loaded the font files — no @font-face, no font assets. The fonts only rendered on machines that had them installed locally and silently fell back to the system sans-serif everywhere else. This adds the variable font files under src/fonts/ and src/fonts.css with @font-face declarations, bundled through Vite so the keycloakify build rewrites the asset paths onto Keycloak's resources path — mirroring the working setup in helpwave/tasks.

3. Automated NixOS plugin pins

docs/deployment-nixos.md previously carried placeholder sha256-AAAA… hashes the operator had to compute by hand. Now:

• scripts/update-nixos-plugin-pins.mjs (npm run update-nix-pins) pins the doc to a GitHub release: themeVersion from the tag, spiVersion from the SPI jar file names, and SRI hashes converted from the sha256 digests the GitHub API reports per release asset (fallback: download + hash). Replacements are anchored to jar file names and must match exactly once — hashes can never land on the wrong plugin, and doc-shape drift fails loudly. Supports --tag, --check, --release-json.
• CI: after create_github_release, the new update_nixos_plugin_pins job re-pins the doc against the freshly published tag and commits to main. The checked-in Nix snippet always matches the latest release — copy it as-is.
• docs/deployment-nixos.md restructured: the module example now uses the release = ver: file: sha: pin block with real, verified v0.6.0 hashes (validated against the GitHub API asset digests), and the updating section documents the whole repeatable motion: bump version → CI releases → CI re-pins docs → nixos-rebuild switch.
• README.md restructured: table of contents, grouped development/deployment sections, fixed duplicated section numbering, new "Releases & version pinning" section.

Testing

• tsc --noEmit, eslint . — pass
• vite build — succeeds; both .ttf files emitted as hashed assets referenced from the built CSS
• Pin script: verified update, idempotency, --check (fresh/stale), missing-asset and SPI-version-mismatch error paths against the real v0.6.0 release data; the four SRI hashes in the doc match the GitHub asset digests
• Workflow YAML parses; the pins job is skipped for pre-releases

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying id-helpwave-de with    Cloudflare Pages

Latest commit:	277fb3e
Status:	✅  Deploy successful!
Preview URL:	https://59629187.id-helpwave-de.pages.dev
Branch Preview URL:	https://claude-labelled-checkbox-spa.id-helpwave-de.pages.dev

View logs