chore: relicense under BUSL-1.1 and add SPDX headers

[lmcorbalan]

Summary

No related issue. Moves the project from MIT to the Business Source License 1.1, matching the license BootNode uses on its other projects, and adds an SPDX header to every source file in the style of canton-network/splice.

Changes

• LICENSE: BUSL-1.1 with Licensor BootNode, Licensed Work "Canton Token Forge", Additional Use Grant None, Change Date October 15, 2030, Change License GPL v2.0 or later
• Two-line Copyright (c) 2026 BootNode. All rights reserved. / SPDX-License-Identifier: BUSL-1.1 header on 68 files (23 .daml, 37 .ts, 2 .mjs, 6 .sh), placed after the shebang where there is one; the .claude/ skill scripts are left out as shared tooling
• package.json and the root package-lock.json entry declare BUSL-1.1; README.md License section updated
• SPEC.md: license sentence updated, and the line counts refreshed for the added headers (976/ 2508 / 1846 / 4693 to 1003 / 2547 / 1894 / 4750)

Acceptance criteria

• Every tracked .daml, .ts, .mjs and .sh file outside .claude/ carries the SPDX header
• No tracked file still names MIT

Test plan

Automated tests

• npm run build, npm test (80/80 scenarios), npm run smoke
• registry/: npm run lint, npm run build, npm run typecheck:test, npm test (246/246)
• npm run smoke:registry

Manual verification

• npm run test:e2e against a local sandbox (Canton 3.5.12): 18/18
• grep -L 'SPDX-License-Identifier: BUSL-1.1' over the tracked source files returns nothing

Breaking changes

• The license is no longer open source: production use requires a commercial license from BootNode until the Change Date. Releases v0.1.0 to v0.3.0 remain MIT.
• The header lines shift the source locations compiled into the Daml package, so the next DAR has a new package-id and sha256 even though the package version is still 0.0.1.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.