feat(admin): licence issuance with plan snapshots and supersession

Issue is the only place that signs. It records the licence, supersedes its
predecessor and updates the instance -- but deliberately does not deliver.

The ordering matters: a licence recorded but not delivered is recoverable,
because the customer can download it. A licence delivered but not recorded
is a support mystery with no paper trail.

Free stays cloud-only through one comparison of plan against instance
deployment, not a flag. Renewals reset relink_count because the cap is per
term.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/cmd/main.go

@@ -13,6 +13,7 @@ import (
 	"github.com/joho/godotenv"
 	"github.com/mrhid6/vantage/admin/internal/config"
 	"github.com/mrhid6/vantage/admin/internal/db"
+	"github.com/mrhid6/vantage/admin/internal/licensing"
 	"github.com/mrhid6/vantage/admin/internal/models"
 )
 
@@ -24,6 +25,8 @@ func main() {
 		log.Fatalf("configuration error: %v", err)
 	}
 
+	licensing.SetSigningKey(cfg.SigningKey)
+
 	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	if err := db.Connect(ctx, cfg); err != nil {
 		cancel()