feat: add license validation and entitlements (Rust) (#46)

Introduces the offline license infrastructure for the Base/Premium editions.

- jsonwebtoken (EdDSA) verifies license JWTs against an embedded Ed25519
  public key. The exp claim is mandatory (CWE-613) and is enforced via
  Validation::set_required_spec_claims.
- Activation tokens (server-issued, machine-bound) prevent license.key
  copying between machines. Storage is wired up; the actual issuance flow
  ships with Issue #49.
- get_edition() fails closed to "free" when the license is missing,
  invalid, expired, or activated for a different machine.
- New commands/entitlements module centralizes feature → tier mapping so
  Issue #48 (and any future gate) reads from a single source of truth.
- machine-uid provides the cross-platform machine identifier; OS reinstall
  invalidates the activation token by design.
- Tests cover happy path, expiry, wrong-key signature, malformed JWT,
  unknown edition, and machine_id matching for activation tokens.

The embedded PUBLIC_KEY_PEM is the RFC 8410 §10.3 test vector, clearly
labelled as a development placeholder; replacing it with the production
public key is a release-time task.

.forgejo/workflows/check.yml

@@ -1,94 +0,0 @@
-name: PR Check
-
-# Validates Rust + frontend on every branch push and PR.
-# Goal: catch compile errors, type errors, and failing tests BEFORE merge,
-# instead of waiting for the release tag (which is when release.yml runs).
-
-on:
-  push:
-    branches-ignore:
-      - main
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  rust:
-    runs-on: ubuntu
-    container: ubuntu:22.04
-    env:
-      PATH: /root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-      CARGO_TERM_COLOR: always
-    steps:
-      - name: Install system dependencies
-        run: |
-          apt-get update
-          apt-get install -y --no-install-recommends \
-            curl wget git ca-certificates build-essential pkg-config \
-            libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libssl-dev
-
-      - name: Install Rust toolchain (stable)
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
-          rustc --version
-          cargo --version
-
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Cache cargo registry and git
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-registry-
-
-      - name: Cache cargo build target
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: src-tauri/target
-          key: ${{ runner.os }}-cargo-target-${{ hashFiles('src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-target-
-
-      - name: cargo check
-        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
-
-      - name: cargo test
-        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
-
-  frontend:
-    runs-on: ubuntu
-    container: ubuntu:22.04
-    steps:
-      - name: Install Node.js 20
-        run: |
-          apt-get update
-          apt-get install -y --no-install-recommends curl ca-certificates git
-          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
-          apt-get install -y nodejs
-          node --version
-          npm --version
-
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Cache npm cache
-        uses: https://github.com/actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build (tsc + vite)
-        run: npm run build
-
-      - name: Tests (vitest)
-        run: npm test

.github/workflows/check.yml

@@ -1,68 +0,0 @@
-name: PR Check
-
-# Mirror of .forgejo/workflows/check.yml using GitHub-native runners.
-# Forgejo is the primary host; this file keeps the GitHub mirror functional.
-
-on:
-  push:
-    branches-ignore:
-      - main
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  rust:
-    runs-on: ubuntu-latest
-    env:
-      CARGO_TERM_COLOR: always
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            pkg-config libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libssl-dev
-
-      - name: Install Rust toolchain (stable)
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            src-tauri/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: cargo check
-        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
-
-      - name: cargo test
-        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
-
-  frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js 20
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build (tsc + vite)
-        run: npm run build
-
-      - name: Tests (vitest)
-        run: npm test

CHANGELOG.fr.md

@@ -2,9 +2,6 @@
 
 ## [Non publié]
 
-### Ajouté
-- CI : nouveau workflow `check.yml` qui exécute `cargo check`/`cargo test` et le build frontend sur chaque push de branche et PR, détectant les erreurs avant le merge plutôt qu'au moment de la release (#60)
-
 ## [0.6.7] - 2026-03-29
 
 ### Modifié

CHANGELOG.md

@@ -2,9 +2,6 @@
 
 ## [Unreleased]
 
-### Added
-- CI: new `check.yml` workflow runs `cargo check`/`cargo test` and the frontend build on every branch push and PR, catching errors before merge instead of waiting for the release tag (#60)
-
 ## [0.6.7] - 2026-03-29
 
 ### Changed

CLAUDE.md

@@ -157,8 +157,9 @@ Pour maintenir l'éligibilité aux crédits d'impôt R&D (RS&DE fédéral + CRIC
 
 ## CI/CD
 
-- **`check.yml`** (Forgejo Actions + miroir GitHub) — déclenché sur chaque push de branche (sauf `main`) et chaque PR vers `main`. Lance `cargo check`, `cargo test`, `npm run build` (tsc + vite) et `npm test` (vitest). Doit être vert avant tout merge.
+- GitHub Actions (`release.yml`) déclenché par tags `v*`
-- **`release.yml`** — déclenché par les tags `v*`. Build Windows (NSIS `.exe`) + Linux (`.deb`, `.rpm`), signe les binaires et publie le JSON d'updater pour les mises à jour automatiques.
+- Build Windows (NSIS `.exe`) + Linux (`.deb`, `.rpm`)
+- Signature des binaires + JSON d'updater pour mises à jour automatiques
 
 ---