feat(cloud): heartbeat returns a signed license token (Ed25519)

Sites now enforce their license offline (client-services KI-006): the
cloud is needed to renew a license, not to run it. Each heartbeat carries
license_token = base64url(payload).base64url(signature), payload
{v:1, site_id, active, locked, lock_reason, expires_at, issued_at}, signed
with LICENSE_SIGNING_KEY (base64 raw Ed25519 private key, cloud .env). The
matching public key is built into the site code, so a stored token can't be
edited and a clock can't be set before issued_at unnoticed.

Additive field only (old sites ignore it). Without the key the field is
null and a warning is logged. Pins cryptography==46.0.4 (was transitive).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cloud_backend/routers/heartbeat.py

@@ -7,6 +7,7 @@ from config import settings
 from database import get_db
 from models.site import Site
 from schemas.site import HeartbeatRequest, HeartbeatResponse
+from services.license_token import issue_license_token
 
 router = APIRouter()
 _pwd = CryptContext(schemes=["bcrypt"], deprecated="auto")
@@ -40,4 +41,5 @@ def heartbeat(
         latest_version=settings.LATEST_VERSION,
         waiter_domain=site.waiter_domain,
         site_numeric_id=site.id,
+        license_token=issue_license_token(site, now),
     )