licence: relicense MIT -> AGPL-3.0-or-later

lectio was MIT, which let anyone take it closed. The concern is not people
selling it -- no licence stops that, and the AGPL does not try to -- but
someone building a proprietary product on it and giving nothing back.

Plain GPL would leave the obvious hole open: lectio-web is a network
service, and hosting is not distribution, so a modified lectio-web could be
run as a paid subscription API without ever publishing a line. AGPL section
13 closes exactly that.

LICENSE is the verbatim FSF text. README carries the standard notice.

Section 13 requires a modified network-reachable version to PROMINENTLY
offer its source to the users interacting with it, so the offer ships with
the code rather than living only in a file nobody fetches:

  - GET /source          plain text, no template or config dependency, so
                         it answers even when something else is broken
  - page footers         every full page (fragments render inside one)
  - JSON envelope        "source" / "license"
  - iCal header          X-LECTIO-SOURCE / X-LECTIO-LICENSE

The feed fields are not redundant: an /api/calendar.json consumer or an
.ics subscriber never loads a page, so the footer alone would miss them.

config.SourceURL is the single source of truth, and says in its comment
that a fork running as a service must repoint it -- an offer that leads to
someone else's code is not an offer.

Tests pin all of it. This is a licence obligation, not a feature, so it
should fail loudly if a later change drops it.

1 files changed, 18 insertions, 0 deletions

diff --git a/internal/calfeed/ical_test.go b/internal/calfeed/ical_test.go
index fb7ee9a..215c0e3 100644
--- a/internal/calfeed/ical_test.go
+++ b/internal/calfeed/ical_test.go
@@ -4,6 +4,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/lukaszkasprzak/lectio/internal/config"
 )
 
 func TestICalEscapeInjection(t *testing.T) {
@@ -19,6 +21,22 @@ func TestICalEscapeInjection(t *testing.T) {
 	}
 }
 
+// TestICalCarriesSourceOffer pins the AGPL-3.0 §13 offer into the VCALENDAR
+// header. Someone who subscribes to /calendar.ics in their calendar app sees
+// no lectio page at all; the feed is their entire view of the program, so it
+// carries the offer. X- properties are inert to clients that ignore them.
+func TestICalCarriesSourceOffer(t *testing.T) {
+	out := string(ICal("new", nil, time.Date(2026, 7, 27, 12, 0, 0, 0, time.UTC)))
+	for _, want := range []string{
+		"X-LECTIO-SOURCE:" + icalEscape(config.SourceURL),
+		"X-LECTIO-LICENSE:" + icalEscape(config.License),
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("missing %q in:\n%s", want, out)
+		}
+	}
+}
+
 func TestICalStructure(t *testing.T) {
 	days := []DayView{{
 		Date: "2026-01-06", Season: "time-after-epiphany", Week: 1, Colour: "white",