chore: relicense the Seamless Auth ecosystem to Apache-2.0

[Bccorb]

Part of #334.

Decision

Relicense the whole ecosystem from AGPL-3.0-only to Apache-2.0: the API, the SDKs, types, CLI, templates, messaging, admin dashboard and docs.

The SDKs are the main reason. @seamless-auth/react, client, core, express, fastify and types are all AGPL-3.0-only today and get bundled or linked into the adopter's own application, which most company and government legal reviews will block. Apache-2.0 over MIT for the explicit patent grant, which those same reviewers look for.

Before changing any file

External contributors hold copyright in their contributions and have to agree to the change (or those contributions are rewritten). From git log:

Repo	Contributors other than the maintainer
seamless-auth-react	Peter (12 commits), nightcityblade (1), kcorbettsr (1)
seamless-cli	Bharat Bhojwani (1)
seamless-auth-docs	Peter (11 commits)

• Written consent from each, recorded on this issue or linked from it
• Re-check every repo's history for new contributors right before switching

Per repo

For each of seamless-auth-api, seamless-auth-server, seamless-auth-react, seamless-auth-types, seamless-cli, seamless-templates, seamless-auth-messaging, seamless-auth-admin-dashboard, seamless-auth-docs:

• Replace LICENSE / LICENSE.md with the Apache-2.0 text (and remove duplicates; several repos have both)
• license field in every package.json, including workspace packages (some are missing it entirely)
• Update the license header rule in eslint config and rewrite the header in every source file
• README license section
• Changeset (minor, describing the change) for each published package

Known leftovers to clean up on the way: seamless-auth-react/LICENSE.md still has template boilerplate, and seamless-auth-server/packages/fastify/LICENSE.md calls itself the Express package.

Outside the repos

• Website license page and pricing: remove the commercial license tier and the AGPL wording. In fells-code/seamless-website#21
• Docs: any page that mentions AGPL
• Update the licensing milestone in Path to 1.0: production-readiness and adoption gaps #66. Noted on Path to 1.0: production-readiness and adoption gaps #66

[Bccorb]

Written consent to relicense under Apache-2.0 has been obtained from every external contributor listed above (seamless-auth-react: Peter, nightcityblade, kcorbettsr; seamless-cli: Bharat Bhojwani; seamless-auth-docs: Peter). Still to do right before switching: re-check each repo's history for contributors added since.

[Bccorb]

Relicense PRs are open for every repo. Before starting, I re-checked each repo's history for new outside contributors and found none beyond the ones listed above, whose consent is recorded here.

Repo	PR
seamless-auth-api	#349
seamless-auth-types	fells-code/seamless-auth-types#85
seamless-auth-server (core, express, fastify, nextjs)	fells-code/seamless-auth-server#174
seamless-auth-react (client, react, react-native)	fells-code/seamless-auth-react#158
seamless-cli	fells-code/seamless-cli#218
seamless-templates	fells-code/seamless-templates#96
seamless-auth-messaging	fells-code/seamless-auth-messaging#5
seamless-auth-admin-dashboard	fells-code/seamless-auth-admin-dashboard#272
seamless-auth-docs	fells-code/seamless-auth-docs#50
Website: license page, pricing, footer	fells-code/seamless-website#21

Every repo now has the canonical Apache-2.0 LICENSE, with SHA-256 cfc7749b…3d30, the hash of the apache.org text. The AGPL LICENSE.md summaries are removed, including the template boilerplate and the Fastify one mislabelled as Express. Several of the old LICENSE files were truncated 79-line copies of the AGPL. The license fields, the license headers (and the eslint header templates where they exist), and the README badges and sections are updated. Each published package gets a minor changeset, except messaging, which releases by version bump.

Docs: no page mentions the AGPL. #66's licensing milestone now notes this decision and ticks when these merge.

Each published package's own lockfile entry is updated in its PR. Lockfile entries that point at a published @seamless-auth/* dependency keep AGPL-3.0-only until that package is released under Apache-2.0 and the dependency is bumped. So releasing types, messaging, server and react first and then bumping the API, templates and dashboard clears them.