license: relicense to AGPL-3.0-only with commercial dual-license

- LICENSE -> verbatim GNU AGPL-3.0; add LICENSE-COMMERCIAL.md + SECURITY.md
- CLA -> exclusive-license grant (contributors keep copyright); add README
  anti-rugpull covenant + relicense record
- NOTICE / README / CONTRIBUTING / CLAUDE.md / package.json x5 updated;
  contact routed through GitHub (no email placeholders)
- AGPL section 13 source offer: operator-configurable BACKSPACE_SOURCE_URL +
  build-injected commit; sourceCodeUrl+commit on /api/instance/info;
  SourceCodeLink on login/register/settings/desktop; docs + .env.example updated

.env.example

@@ -19,6 +19,18 @@ REGISTRATION_OPEN=true
 # Max file upload size in bytes (default: 100MB)
 MAX_UPLOAD_SIZE=104857600
 
+# ─── AGPL-3.0 § 13 Source Offer ────────────────────────────
+# Backspace is AGPL-3.0. Network users can obtain the source of the running
+# version via GET /api/instance/info and in-app "Source code (AGPL)" links.
+# If you MODIFY Backspace and self-host it, you MUST point this at YOUR fork's
+# source so the offer stays accurate. Defaults to the upstream repository.
+# BACKSPACE_SOURCE_URL=https://github.com/TheZwiss/backspace
+#
+# Short git commit/tag of the running build. Injected automatically at Docker
+# build time by deploy.sh (--build-arg BACKSPACE_COMMIT). Leave unset for local
+# dev — the app reports commit=null. Set manually only for custom build pipelines.
+# BACKSPACE_COMMIT=
+
 # ─── LiveKit Voice/Video ───────────────────────────────────
 # To enable voice/video, fill in all three values below and add:
 #   COMPOSE_PROFILES=voice