licence: relicense MIT -> AGPL-3.0-or-later

lectio was MIT, which let anyone take it closed. The concern is not people
selling it -- no licence stops that, and the AGPL does not try to -- but
someone building a proprietary product on it and giving nothing back.

Plain GPL would leave the obvious hole open: lectio-web is a network
service, and hosting is not distribution, so a modified lectio-web could be
run as a paid subscription API without ever publishing a line. AGPL section
13 closes exactly that.

LICENSE is the verbatim FSF text. README carries the standard notice.

Section 13 requires a modified network-reachable version to PROMINENTLY
offer its source to the users interacting with it, so the offer ships with
the code rather than living only in a file nobody fetches:

  - GET /source          plain text, no template or config dependency, so
                         it answers even when something else is broken
  - page footers         every full page (fragments render inside one)
  - JSON envelope        "source" / "license"
  - iCal header          X-LECTIO-SOURCE / X-LECTIO-LICENSE

The feed fields are not redundant: an /api/calendar.json consumer or an
.ics subscriber never loads a page, so the footer alone would miss them.

config.SourceURL is the single source of truth, and says in its comment
that a fork running as a service must repoint it -- an offer that leads to
someone else's code is not an offer.

Tests pin all of it. This is a licence obligation, not a feature, so it
should fail loudly if a later change drops it.

1 files changed, 16 insertions, 5 deletions

diff --git a/internal/calfeed/json.go b/internal/calfeed/json.go
index c1a50ca..1cb0b6f 100644
--- a/internal/calfeed/json.go
+++ b/internal/calfeed/json.go
@@ -1,17 +1,28 @@
 package calfeed
 
-import "encoding/json"
+import (
+	"encoding/json"
+
+	"github.com/lukaszkasprzak/lectio/internal/config"
+)
 
 const Schema = "lectio.calendar/1"
 
 // JSON renders days as the stable lectio.calendar/1 envelope.
+//
+// "source" and "license" carry the AGPL-3.0 §13 offer to consumers who only
+// ever see this endpoint and never load the HTML UI. They are envelope
+// metadata, not day data -- adding them does not change the schema version,
+// since existing consumers read "days".
 func JSON(form string, days []DayView) ([]byte, error) {
 	if days == nil {
 		days = []DayView{}
 	}
 	return json.MarshalIndent(struct {
-		Schema string    `json:"schema"`
-		Form   string    `json:"form"`
-		Days   []DayView `json:"days"`
-	}{Schema, form, days}, "", "  ")
+		Schema  string    `json:"schema"`
+		Form    string    `json:"form"`
+		Source  string    `json:"source"`
+		License string    `json:"license"`
+		Days    []DayView `json:"days"`
+	}{Schema, form, config.SourceURL, config.License, days}, "", "  ")
 }