chore: license MeshBay — LGPL protocol layer, AGPL for the rest

The protocol layer is LGPL-3.0-or-later in every language it exists in, so
any client may use it whatever its own licence: meshbay-common, and the files
marked with an SPDX line — keyderive.js, crypto.js, playlist-crypto.js,
transport*.js; keyring.js, transcripts.js and argon2-wasm.js on the desktop;
Kdf.kt, Keyring.kt and Transcripts.kt on Android. Everything else is
AGPL-3.0-or-later, which the RPM specs and package.json already declared
without a licence file to back them.

Two AGPL section 7 permissions:
- group applications may be under any licence when they use the interface
  only through a named surface (static/licenses/APPLICATION-EXCEPTION.txt);
  the reference application is 0BSD so that copying it brings no AGPL code;
- the Android application may be conveyed linked with Google Play services.

Third-party code is accounted for: THIRD-PARTY-NOTICES.txt is generated from
what a build ships (packaging/third_party_notices.py) for the deb/rpm venv and
the frozen Windows node — PyAV's wheel grafts in libx264 and libx265, which its
BSD licence does not mention — and the vendored browser libraries get their
licence texts and htm-preact.js its provenance. Wheels carry SPDX metadata,
RPMs %license, debs a DEP-5 copyright file, every Windows target LICENSE.txt.

test_licensing.py holds the line: the LGPL layer imports nothing under the
AGPL, the reference application nothing outside the application interface,
and every SPDX line is one of the known ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 16 insertions, 4 deletions

diff --git a/packaging/rpm/meshbay-client.spec b/packaging/rpm/meshbay-client.spec
index 0816741..e4f9f03 100644
--- a/packaging/rpm/meshbay-client.spec
+++ b/packaging/rpm/meshbay-client.spec
@@ -2,7 +2,7 @@ Name:           meshbay-client
 Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay — peer-to-peer file sharing, streaming and group chat
-License:        AGPLv3+
+License:        AGPL-3.0-or-later
 URL:            https://meshbay.org
 
 AutoReqProv:    no
@@ -35,6 +35,7 @@ launcher named "MeshBay".
 
 %install
 cp -a %{_staging_root}/* %{buildroot}/
+install -Dm644 -t %{buildroot}%{_licensedir}/%{name} %{_repo_root}/LICENSE
 
 %post
 if [ -f /opt/meshbay-client/chrome-sandbox ]; then
@@ -49,6 +50,7 @@ update-desktop-database /usr/share/applications 2>/dev/null || true
 gtk-update-icon-cache -f -t /usr/share/icons/hicolor 2>/dev/null || true
 
 %files
+%license %{_licensedir}/%{name}
 /opt/meshbay-client
 /usr/bin/meshbay
 /usr/share/applications/meshbay.desktop
diff --git a/packaging/rpm/meshbay-common.spec b/packaging/rpm/meshbay-common.spec
index 147dc17..cad00b7 100644
--- a/packaging/rpm/meshbay-common.spec
+++ b/packaging/rpm/meshbay-common.spec
@@ -2,7 +2,9 @@ Name:           meshbay-common
 Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay shared Python runtime and libraries
-License:        AGPLv3+
+# The venv carries every Python dependency, each under its own licence:
+# /opt/meshbay-common/THIRD-PARTY-NOTICES.txt lists them.
+License:        LGPL-3.0-or-later
 URL:            https://meshbay.org
 
 AutoReqProv:    no
@@ -16,6 +18,9 @@ Installs to /opt/meshbay-common/venv/.
 
 %install
 cp -a %{_staging_root}/* %{buildroot}/
+install -Dm644 -t %{buildroot}%{_licensedir}/%{name} \
+    %{_repo_root}/packages/meshbay-common/COPYING \
+    %{_repo_root}/packages/meshbay-common/COPYING.LESSER
 
 # Bytecode written at run time into __pycache__ is not the package's, and would
 # keep rpm from removing a directory the new version no longer ships.
@@ -32,6 +37,7 @@ if [ "$1" -eq 0 ]; then
 fi
 
 %files
+%license %{_licensedir}/%{name}
 /opt/meshbay-common
 
 %changelog
diff --git a/packaging/rpm/meshbay-hub.spec b/packaging/rpm/meshbay-hub.spec
index ffd991a..141f6e6 100644
--- a/packaging/rpm/meshbay-hub.spec
+++ b/packaging/rpm/meshbay-hub.spec
@@ -2,7 +2,7 @@ Name:           meshbay-hub
 Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay Hub — identity authority and group registry server
-License:        AGPLv3+
+License:        AGPL-3.0-or-later
 URL:            https://meshbay.org
 
 AutoReqProv:    no
@@ -21,6 +21,7 @@ Runs as a systemd service behind Caddy for HTTPS.
 
 %install
 cp -a %{_staging_root}/* %{buildroot}/
+install -Dm644 -t %{buildroot}%{_licensedir}/%{name} %{_repo_root}/LICENSE
 
 %pre
 getent group meshbay >/dev/null || groupadd -r meshbay
@@ -51,6 +52,7 @@ fi
 %systemd_postun_with_restart meshbay-hub.service
 
 %files
+%license %{_licensedir}/%{name}
 /opt/meshbay-hub
 /opt/meshbay-common/venv/lib/python*/site-packages/meshbay_hub/
 /opt/meshbay-common/venv/lib/python*/site-packages/meshbay_hub-*.dist-info/
diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec
index 89f3a0a..18d432e 100644
--- a/packaging/rpm/meshbay-node.spec
+++ b/packaging/rpm/meshbay-node.spec
@@ -2,7 +2,7 @@ Name:           meshbay-node
 Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay Node — local file host, streaming server, and group daemon
-License:        AGPLv3+
+License:        AGPL-3.0-or-later
 URL:            https://meshbay.org
 
 AutoReqProv:    no
@@ -29,6 +29,7 @@ Runs as a systemd user service.
 
 %install
 cp -a %{_staging_root}/* %{buildroot}/
+install -Dm644 -t %{buildroot}%{_licensedir}/%{name} %{_repo_root}/LICENSE
 
 %post
 if [ -d /run/systemd/system ]; then
@@ -90,6 +91,7 @@ if [ "$1" -eq 0 ]; then
 fi
 
 %files
+%license %{_licensedir}/%{name}
 /opt/meshbay-node
 /opt/meshbay-common/venv/lib/python*/site-packages/meshbay_node/
 /opt/meshbay-common/venv/lib/python*/site-packages/meshbay_node-*.dist-info/