license: relicense to AGPL-3.0-only with commercial dual-license

- LICENSE -> verbatim GNU AGPL-3.0; add LICENSE-COMMERCIAL.md + SECURITY.md
- CLA -> exclusive-license grant (contributors keep copyright); add README
  anti-rugpull covenant + relicense record
- NOTICE / README / CONTRIBUTING / CLAUDE.md / package.json x5 updated;
  contact routed through GitHub (no email placeholders)
- AGPL section 13 source offer: operator-configurable BACKSPACE_SOURCE_URL +
  build-injected commit; sourceCodeUrl+commit on /api/instance/info;
  SourceCodeLink on login/register/settings/desktop; docs + .env.example updated

docker-compose.yml

@@ -10,7 +10,13 @@
 services:
   # ── Backspace application server ──────────────────────────
   backspace:
-    build: .
+    build:
+      context: .
+      args:
+        # AGPL-3.0 § 13: bake the running build's git commit into the image so
+        # /api/instance/info advertises the exact version. deploy.sh exports
+        # BACKSPACE_COMMIT before `docker compose build`; empty when unset.
+        BACKSPACE_COMMIT: ${BACKSPACE_COMMIT:-}
     container_name: backspace
     restart: unless-stopped
     volumes: