license: relicense to AGPL-3.0-only with commercial dual-license

- LICENSE -> verbatim GNU AGPL-3.0; add LICENSE-COMMERCIAL.md + SECURITY.md
- CLA -> exclusive-license grant (contributors keep copyright); add README
  anti-rugpull covenant + relicense record
- NOTICE / README / CONTRIBUTING / CLAUDE.md / package.json x5 updated;
  contact routed through GitHub (no email placeholders)
- AGPL section 13 source offer: operator-configurable BACKSPACE_SOURCE_URL +
  build-injected commit; sourceCodeUrl+commit on /api/instance/info;
  SourceCodeLink on login/register/settings/desktop; docs + .env.example updated

packages/shared/src/types.ts

@@ -798,6 +798,12 @@ export interface InstanceInfoResponse {
   version: string;
   registrationOpen: boolean;
   federatedRegistrationOpen: boolean;
+  // AGPL-3.0 § 13 network-use source offer: URL to the Corresponding Source of
+  // the version this instance is running (operator-configurable via
+  // BACKSPACE_SOURCE_URL so forks point at their own source).
+  sourceCodeUrl: string;
+  // Short git SHA/tag of the running build; null in dev builds with no commit injected.
+  commit: string | null;
 }
 
 export interface VerifyPasswordRequest {