v0.4: licensing — server validation, DPAPI cache, Ed25519 signed responses

UX bonus: clicking "Reprendre" on an interrupted download skips the
release-notes confirmation dialog (the user already approved when they
first clicked Installer).

Server side
-----------
- migrations/001_init.sql: licenses, license_machines, rate_limit,
  audit_log on InnoDB/utf8mb4. Foreign keys, unique on license_key, slot
  uniqueness per (license_id, machine_id).
- api/lib/Db.php: thin PDO singleton (exception mode, prepared, no emul).
- api/lib/Crypto.php: Ed25519 sign/verify via libsodium (sodium_crypto_*),
  HMAC-SHA-256 helper for v0.6, canonicalJson() that strips `signature`
  before serializing — must match exactly the encoding done client-side
  before verify.
- api/routes/ValidateLicense.php: POST /license/validate. Looks up the
  key, walks the machine slot logic (insert or update last_seen),
  enforces max_machines, returns a payload signed Ed25519 + status of
  valid/expired/revoked/machine_limit_exceeded/invalid. Audit logs every
  outcome. Rate-limit 10/min/IP via the rate_limit table.
- tools/generate-keypair.php: prints a fresh sodium keypair so the
  operator drops the hex into config.php and the public_key_hex into the
  launcher resource.
- tools/issue-license.php: PRSRV-XXXX-XXXX-XXXX-XXXX generator (32-char
  unambiguous alphabet), inserts the license, prints the key once.
- tools/sign-manifest.php: now also signs the manifest itself with
  Ed25519 after computing the per-zip sha256s.
- config.example.php: schema rewritten with sections db / hmac / ed25519
  / jwt / rate-limit. config.php remains gitignored.

Client side
-----------
- Models/License.cs: LicenseValidationRequest + LicenseValidationResponse
  with CanDownload(VersionManifest) — entitlement_until vs version's
  minLicenseDate. The status valid|expired|revoked|machine_limit_exceeded
  flow is preserved end-to-end.
- Core/Licensing/LicenseService.cs:
  * machineId = SHA-256 of HKLM/Software/Microsoft/Cryptography/MachineGuid
    + UserName (stable, no PII leak)
  * online ValidateAsync calls /license/validate with launcher version
  * embedded server-pubkey.txt drives Ed25519 verification of the
    response (skipped gracefully if pubkey not yet provisioned)
  * SaveCached / GetCached use DPAPI CurrentUser scope on the license
    key; the cleartext key never touches disk
  * GetCached has a 7-day offline grace window after the last successful
    validation, so going offline doesn't lock the user out
- Core/Resources/server-pubkey.txt: EmbeddedResource. Default content is
  a comment, which the service treats as "no pubkey configured" and
  bypasses verification. Operator pastes the real hex post-deploy and
  rebuilds.
- Core/PSLauncher.Core.csproj: Polly, NSec.Cryptography (Ed25519),
  System.Security.Cryptography.ProtectedData (DPAPI).
- App/Views/OnboardingDialog.xaml(.cs): first-launch / "🔑 Activer"
  modal. Calls LicenseService, displays status messages with red
  foreground on errors and green-tinted secondary text otherwise.
- ViewModels/VersionRowViewModel.cs: new LicenseAllowsDownload property.
  Install button label switches to "🔒 License insuffisante" when the
  user's entitlement_until precedes the version's minLicenseDate;
  CanInstall is false in that case so the click is a no-op too.
- ViewModels/MainViewModel.cs: loads the cached license at startup (no
  network call), surfaces it as LicenseSummary in the top bar, exposes
  ActivateLicenseCommand to (re)open the onboarding dialog. RebuildList
  applies the per-version license filter so older installed versions
  remain launchable but newer-than-license ones can't be downloaded.
- Views/MainWindow.xaml: top bar gains a "🔑 Activer / changer" button
  next to the license summary.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/api/lib/Crypto.php

@@ -0,0 +1,65 @@
+<?php
+declare(strict_types=1);
+
+namespace PSLauncher;
+
+final class Crypto
+{
+    /**
+     * Signe un payload (chaîne canonical UTF-8) avec la clé privée Ed25519.
+     * Retourne la signature en base64.
+     */
+    public static function signEd25519(string $payload, string $privateKeyHex): string
+    {
+        if (strlen($privateKeyHex) !== 128) {
+            throw new \InvalidArgumentException('private_key_hex must be 128 hex chars (sodium secret key)');
+        }
+        $sk = sodium_hex2bin($privateKeyHex);
+        $sig = sodium_crypto_sign_detached($payload, $sk);
+        return base64_encode($sig);
+    }
+
+    /**
+     * Génère un nouveau keypair Ed25519 et retourne ['private_key_hex', 'public_key_hex'].
+     */
+    public static function generateKeypair(): array
+    {
+        $kp = sodium_crypto_sign_keypair();
+        $sk = sodium_crypto_sign_secretkey($kp);
+        $pk = sodium_crypto_sign_publickey($kp);
+        return [
+            'private_key_hex' => sodium_bin2hex($sk),
+            'public_key_hex'  => sodium_bin2hex($pk),
+        ];
+    }
+
+    /**
+     * Encodage canonical d'un objet JSON pour la signature : on retire le champ
+     * `signature` (s'il est là), on encode sans escapes inutiles, on signe ce blob.
+     * Le client doit faire EXACTEMENT le même encodage avant verify.
+     */
+    public static function canonicalJson(array $data): string
+    {
+        unset($data['signature']);
+        return json_encode(
+            $data,
+            JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRESERVE_ZERO_FRACTION
+        );
+    }
+
+    /**
+     * Hash bcrypt-comparable d'une license_key (constant-time compare).
+     */
+    public static function constantTimeEquals(string $a, string $b): bool
+    {
+        return hash_equals($a, $b);
+    }
+
+    /**
+     * HMAC-SHA-256 hex pour les URLs présignées (v0.6).
+     */
+    public static function hmacHex(string $message, string $secret): string
+    {
+        return hash_hmac('sha256', $message, $secret);
+    }
+}

server/api/lib/Db.php

@@ -0,0 +1,26 @@
+<?php
+declare(strict_types=1);
+
+namespace PSLauncher;
+
+final class Db
+{
+    private static ?\PDO $pdo = null;
+
+    public static function get(array $config): \PDO
+    {
+        if (self::$pdo !== null) return self::$pdo;
+        $cfg = $config['db'];
+        self::$pdo = new \PDO(
+            $cfg['dsn'],
+            $cfg['username'],
+            $cfg['password'],
+            [
+                \PDO::ATTR_ERRMODE            => \PDO::ERRMODE_EXCEPTION,
+                \PDO::ATTR_DEFAULT_FETCH_MODE => \PDO::FETCH_ASSOC,
+                \PDO::ATTR_EMULATE_PREPARES   => false,
+            ]
+        );
+        return self::$pdo;
+    }
+}