Harden open-source self-hosting

[xwchris]

Summary

• define explicit hosted and self-hosted entitlement capabilities
• add branded self-host bootstrap and doctor validation, local API/Auth development stack, and iOS entitlement tests
• complete OpenAPI, governance, security, telemetry, upgrade, license, DCO, migration, and release/SBOM contracts
• harden GitHub Actions, deployment credentials, pairing-code randomness, Dynamic Type, and accessibility

Why

The public repository exposed the core implementation but did not yet provide a complete, enforceable self-hosting contract or sufficiently granular open-source governance and release controls.

Impact

Self-hosted deployments can compile under their own identity without hosted billing or commercial limits. Hosted behavior remains enforced. Redistributed forks must replace reserved Bellwire artwork.

Validation

• npm run lint
• npm run typecheck
• npm run migrations:check
• npm test (25 files, 178 tests)
• npm run build
• npm run dev:smoke
• npm run ios:test:unit (3 tests)
• npm run ios:build
• npm run release:check -- --tag v0.2.0
• npm audit --audit-level=low (0 vulnerabilities)
• DCO sign-off verified