license: relicense to AGPL-3.0-only with commercial dual-license

- LICENSE -> verbatim GNU AGPL-3.0; add LICENSE-COMMERCIAL.md + SECURITY.md
- CLA -> exclusive-license grant (contributors keep copyright); add README
  anti-rugpull covenant + relicense record
- NOTICE / README / CONTRIBUTING / CLAUDE.md / package.json x5 updated;
  contact routed through GitHub (no email placeholders)
- AGPL section 13 source offer: operator-configurable BACKSPACE_SOURCE_URL +
  build-injected commit; sourceCodeUrl+commit on /api/instance/info;
  SourceCodeLink on login/register/settings/desktop; docs + .env.example updated

LICENSE-COMMERCIAL.md

@@ -0,0 +1,58 @@
+# Backspace — Commercial License
+
+Backspace is **dual-licensed**:
+
+1. **Open source** — the GNU Affero General Public License v3.0 (`AGPL-3.0-only`),
+   in the [LICENSE](LICENSE) file. Free for everyone.
+2. **Commercial** — described here, for uses the AGPL does not permit.
+
+## When you need a commercial license
+
+The AGPL-3.0 is a strong copyleft license. You likely need a commercial license
+if you want to:
+
+- embed or distribute Backspace (in whole or in part) inside a **closed-source or
+  proprietary** application;
+- offer Backspace to third parties as a **hosted or managed service without
+  releasing the complete corresponding source** of your modified version to your
+  users (which AGPL § 13 would otherwise require);
+- use Backspace in an **organization that prohibits AGPL** software; or
+- obtain **warranty, indemnity, or support** terms that the AGPL disclaims.
+
+If you self-host Backspace and are willing to comply with the AGPL — including
+publishing the source of any modifications you run as a network service — you do
+**not** need a commercial license. The open-source license already covers you.
+
+## What the commercial license grants
+
+Relief from the AGPL's copyleft obligations for your specific use, under
+negotiated terms (scope, duration, support, and price depend on your use case).
+The maintainer can grant this because the licensing rights in the codebase are
+consolidated via the [Contributor License Agreement](CLA.md).
+
+## Third-party components
+
+A commercial license covers only Backspace's **own** code. Bundled third-party
+components (see [NOTICE](NOTICE)) — including **libvips** (LGPL-3.0-or-later, via
+`sharp`) and the npm dependency tree — remain under their own licenses, and their
+obligations pass through to you. The maintainer cannot and does not license away
+third-party rights he does not own.
+
+## How to obtain one
+
+Commercial licensing is available **on request**. A dedicated licensing contact
+will be added as the project grows; until then, reach the maintainer via GitHub —
+open a discussion or issue on the repository, or contact
+[@TheZwiss](https://github.com/TheZwiss) — with a short description of your
+intended use. Terms are agreed in a separate, signed commercial agreement.
+
+> This document is provided for information only, without warranty. It is **not**
+> an offer that forms a contract, and it does not modify the AGPL. The binding
+> terms of any commercial license are set out solely in a separate signed
+> agreement.
+
+---
+
+Copyright © 2026 Jannis Braun. "Backspace", the Backspace logo, and app icons are
+trademarks of Jannis Braun; no trademark rights are granted by either the AGPL or
+the commercial license.