license: relicense to AGPL-3.0-only with commercial dual-license

- LICENSE -> verbatim GNU AGPL-3.0; add LICENSE-COMMERCIAL.md + SECURITY.md
- CLA -> exclusive-license grant (contributors keep copyright); add README
  anti-rugpull covenant + relicense record
- NOTICE / README / CONTRIBUTING / CLAUDE.md / package.json x5 updated;
  contact routed through GitHub (no email placeholders)
- AGPL section 13 source offer: operator-configurable BACKSPACE_SOURCE_URL +
  build-injected commit; sourceCodeUrl+commit on /api/instance/info;
  SourceCodeLink on login/register/settings/desktop; docs + .env.example updated

packages/server/src/routes/instance.ts

@@ -23,6 +23,10 @@ export async function instanceRoutes(app: FastifyInstance): Promise<void> {
       version: BACKSPACE_VERSION,
       registrationOpen,
       federatedRegistrationOpen: settings?.federatedRegistrationOpen === 1,
+      // AGPL-3.0 § 13: advertise the source of the running version to every
+      // network user (and federated peer) — public/unauthenticated by design.
+      sourceCodeUrl: config.sourceCodeUrl,
+      commit: config.commit,
     };
 
     return reply.code(200).send(response);