feat: add license controller with generate and fetch endpoints

POST /api/tenants/{id}/license generates Ed25519-signed license JWT.
GET /api/tenants/{id}/license returns active license.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/license/LicenseController.java

@@ -0,0 +1,61 @@
+package net.siegeln.cameleer.saas.license;
+
+import net.siegeln.cameleer.saas.license.dto.LicenseResponse;
+import net.siegeln.cameleer.saas.tenant.TenantService;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.time.Duration;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/tenants/{tenantId}/license")
+public class LicenseController {
+
+    private final LicenseService licenseService;
+    private final TenantService tenantService;
+
+    public LicenseController(LicenseService licenseService, TenantService tenantService) {
+        this.licenseService = licenseService;
+        this.tenantService = tenantService;
+    }
+
+    @PostMapping
+    public ResponseEntity<LicenseResponse> generate(@PathVariable UUID tenantId,
+                                                     Authentication authentication) {
+        var tenant = tenantService.getById(tenantId).orElse(null);
+        if (tenant == null) return ResponseEntity.notFound().build();
+
+        UUID actorId = authentication.getCredentials() instanceof UUID uid
+                ? uid : UUID.fromString(authentication.getCredentials().toString());
+
+        var license = licenseService.generateLicense(tenant, Duration.ofDays(365), actorId);
+        return ResponseEntity.status(HttpStatus.CREATED).body(toResponse(license));
+    }
+
+    @GetMapping
+    public ResponseEntity<LicenseResponse> getActive(@PathVariable UUID tenantId) {
+        return licenseService.getActiveLicense(tenantId)
+                .map(entity -> ResponseEntity.ok(toResponse(entity)))
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    private LicenseResponse toResponse(LicenseEntity entity) {
+        return new LicenseResponse(
+                entity.getId(),
+                entity.getTenantId(),
+                entity.getTier(),
+                entity.getFeatures(),
+                entity.getLimits(),
+                entity.getIssuedAt(),
+                entity.getExpiresAt(),
+                entity.getToken()
+        );
+    }
+}

src/main/java/net/siegeln/cameleer/saas/license/dto/LicenseResponse.java

@@ -0,0 +1,16 @@
+package net.siegeln.cameleer.saas.license.dto;
+
+import java.time.Instant;
+import java.util.Map;
+import java.util.UUID;
+
+public record LicenseResponse(
+        UUID id,
+        UUID tenantId,
+        String tier,
+        Map<String, Object> features,
+        Map<String, Object> limits,
+        Instant issuedAt,
+        Instant expiresAt,
+        String token
+) {}