Address CodeRabbit review: font-name traversal + offline test guard

Two Minor findings from CodeRabbit's first review of this PR.

- resolve_font_path: reject relative font names carrying path components.
  font_name comes from plugin config, which the web UI writes; a value like
  "../../config/config.json" escaped assets/fonts/ after os.path.join and let
  a config probe arbitrary paths for existence (disclosure unlikely, since
  Pillow/freetype reject non-font files, but the probe is real). Relative
  names must now be bare filenames (os.path.basename(name) == name); absolute
  paths keep their existing isfile() gate. Test confirms the traversal
  resolved the real config.json before the guard.

- build_manager fixture: patch requests.Session.get BEFORE constructing the
  manager. Construction creates both SportsCore.session and the
  ESPNDataSource.session; the old code only replaced manager.session after
  the fact, leaving data_source.session real and able to reach the network on
  an accidental fetch. Patching the class makes every session built in the
  fixture offline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ

src/element_style.py

@@ -106,6 +106,13 @@ def resolve_font_path(font_name: str) -> Optional[str]:
         return None
     if os.path.isabs(font_name):
         return font_name if os.path.isfile(font_name) else None
+    # A relative name must be a bare filename. font_name comes from plugin
+    # config, which the web UI writes; a value like "../../config/config.json"
+    # would otherwise escape assets/fonts/ once joined and let a config probe
+    # arbitrary paths for existence. os.path.basename collapses any such value
+    # to its last component, so a name that isn't already bare is rejected.
+    if os.path.basename(font_name) != font_name:
+        return None
     candidates = (
         os.path.join(os.getcwd(), _FONTS_SUBDIR, font_name),
         os.path.join(_CORE_ROOT, _FONTS_SUBDIR, font_name),