feat(license): dual-path opsx-licence client alongside HMAC

Wire LIC-/LICOFF- activate/verify/heartbeat to licence.rlwj.cn/api,
keep legacy HMAC accepted with deprecation banner, add instance_id
fingerprint and licensing docs (product lokistack still needs admin create).

backend/services/licence_client_test.go

@@ -0,0 +1,51 @@
+package services
+
+import "testing"
+
+func TestIsOpsxLicenseKey(t *testing.T) {
+	cases := []struct {
+		key  string
+		want bool
+	}{
+		{"LIC-ABC", true},
+		{"LICOFF-1.xxx", true},
+		{"  LIC-x  ", true},
+		{"not-a-key", false},
+		{"", false},
+	}
+	for _, c := range cases {
+		if got := isOpsxLicenseKey(c.key); got != c.want {
+			t.Fatalf("%q: got %v want %v", c.key, got, c.want)
+		}
+	}
+}
+
+func TestNormalizeDoesNotBreakHMAC(t *testing.T) {
+	key, err := GenerateLicenseKey("pro", "personal", "mig-test", 1, 1, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if isOpsxLicenseKey(key) {
+		t.Fatal("HMAC key must not be classified as opsx")
+	}
+	lic, err := VerifyLicenseKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lic.Source != "hmac" || lic.DeprecationNotice == "" {
+		t.Fatalf("HMAC path must set source+deprecation: %+v", lic)
+	}
+}
+
+func TestNormalizeLicenseAPIBaseViaConfigHelper(t *testing.T) {
+	// smoke: constants present
+	if licenceProductCode != "lokistack" {
+		t.Fatal(licenceProductCode)
+	}
+	if weeklyVerifySecs != 7*86400 {
+		t.Fatal(weeklyVerifySecs)
+	}
+	if offlineToleranceSecs != 30*86400 {
+		t.Fatal(offlineToleranceSecs)
+	}
+}