Address two review findings from PR #94:
1. Race condition: concurrent requests could both launch Chromium when
_browser is None. Wrap the init check in asyncio.Lock so only one
coroutine creates the browser process.
2. Font duplication: the WOFF2 files are variable fonts covering all
needed weights. Consolidate 5 @font-face blocks (3x Open Sans,
2x Source Sans 3) into 2 using CSS font-weight range syntax,
saving ~163KB of redundant base64 per render.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>