licence: relicense MIT -> AGPL-3.0-or-later

lectio was MIT, which let anyone take it closed. The concern is not people
selling it -- no licence stops that, and the AGPL does not try to -- but
someone building a proprietary product on it and giving nothing back.

Plain GPL would leave the obvious hole open: lectio-web is a network
service, and hosting is not distribution, so a modified lectio-web could be
run as a paid subscription API without ever publishing a line. AGPL section
13 closes exactly that.

LICENSE is the verbatim FSF text. README carries the standard notice.

Section 13 requires a modified network-reachable version to PROMINENTLY
offer its source to the users interacting with it, so the offer ships with
the code rather than living only in a file nobody fetches:

  - GET /source          plain text, no template or config dependency, so
                         it answers even when something else is broken
  - page footers         every full page (fragments render inside one)
  - JSON envelope        "source" / "license"
  - iCal header          X-LECTIO-SOURCE / X-LECTIO-LICENSE

The feed fields are not redundant: an /api/calendar.json consumer or an
.ics subscriber never loads a page, so the footer alone would miss them.

config.SourceURL is the single source of truth, and says in its comment
that a fork running as a service must repoint it -- an offer that leads to
someone else's code is not an offer.

Tests pin all of it. This is a licence obligation, not a feature, so it
should fail loudly if a later change drops it.

1 files changed, 17 insertions, 0 deletions

diff --git a/internal/config/config.go b/internal/config/config.go
index 31e9078..b6c9e0e 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -64,6 +64,23 @@ const configHeader = `# lectio configuration (INI). Full-line comments only (# o
 // -v/--version output (lectio, lectio-ui, lectio-web).
 const Version = "0.44.0"
 
+// SourceURL is where lectio's corresponding source can be obtained. It is
+// not decoration: lectio is AGPL-3.0-or-later, and section 13 requires a
+// modified version reachable over a network to "prominently offer" its
+// source to the users interacting with it. lectio-web therefore surfaces
+// this on every page (footer -> GET /source) and inside both machine feeds
+// (JSON envelope, iCal X-LECTIO-SOURCE), so an API consumer who never sees
+// the HTML still gets the offer.
+//
+// If you fork lectio and run it as a service, point this at YOUR source.
+// Leaving it aimed here while serving modified code does not satisfy §13 --
+// the offer must lead to the version actually running.
+const SourceURL = "https://github.com/lukaszkasprzak/lectio"
+
+// License is the SPDX identifier lectio ships under, paired with SourceURL
+// wherever the §13 offer is made.
+const License = "AGPL-3.0-or-later"
+
 // validVersions are the scripture versions lectio understands. All are
 // embedded corpora; the former "bt" (the niedziela.pl modern scrape) is gone
 // and a legacy config carrying it is migrated to "wuj" on load (see Load).