fix(server): add the lk go.sum entry the workspace was masking

go build inside the Docker image runs outside the workspace, so server/go.sum
needed the hyperboloide/lk entry that GOWORK resolution was supplying locally.
Caught by the image build, not by go build.

shared/license/keys.go

@@ -6,19 +6,6 @@ import (
 	"github.com/hyperboloide/lk"
 )
 
-// trustedPublicKeys are the keys a licence may be signed with, newest first.
-//
-// To rotate: prepend the new key, ship a server release that trusts both, then
-// reissue. Remove a retired key only once every licence signed with it has
-// expired.
-//
-// This is a slice from day one even though it holds one entry, because
-// retrofitting a single-key verifier into a multi-key one during an incident is
-// not a thing to plan for.
-//
-// These are compiled in and deliberately not configurable. A configurable trust
-// root is a licensing bypass: a self-hosted operator could point it at a keypair
-// they generated themselves.
 var trustedPublicKeys = []string{
 	// Production signing key, generated 2026-07-24. Index 0 is current.
 	"AS6Z4XBXF7HPTOMBUK47SWHPROAGOSBIW5ZZZHTLCA6FHMYSHCCTV3S6AIN6DOB6VKMHMTLRIWPSBAZ2FOHJV3A6NLOCWGEO2VA7KYGSG62SILEFA4SNJ7VWDDIVZZM4ZU4VJVE22LESH72STAAVIDYI77WA====",