fix(license): shared invalid/grace banners + instance copy

Surface expired/over_instance/revoked red banners with CTAs via a
shared LicenseStatusBanners used by settings and ProGate. Hide seats
in product UI; keep HMAC dual-path and never silent-clear keys.

backend/controllers/system.go

@@ -43,13 +43,12 @@ func (ctrl *SystemController) Health(c *gin.Context) {
 	utils.Success(c, services.SelfCheck())
 }
 
-// LicenseStatus 当前授权(登录即可见:前端按 plan 显示锁/引导)
+// LicenseStatus 当前授权(登录即可见:前端按 plan / invalidReason 显示锁/红条)
 func (ctrl *SystemController) LicenseStatus(c *gin.Context) {
-	services.RefreshOpsxLicenseIfDue()
-	lic := services.CurrentLicense()
+	lic, pro := services.LicenseStatusPayload()
 	utils.Success(c, gin.H{
-		"license":  lic.Sanitized(),
-		"pro":      lic != nil,
+		"license":  lic,
+		"pro":      pro,
 		"features": services.ProFeatureList(),
 	})
 }