License Refresh

Subscription renewal receipt for the daemon (docs/ops/backend-contract.md): Authorization: Bearer <previously issued token>. The token's signature proves the device once completed the device flow for that user; we re-read the user's current tenant plan and mint a fresh token from it (new expires_at after a renewal, new limit after an upgrade; a lapsed plan drops to the free tier first, billing.lapse_to_free). 401 bad/foreign token · 401 device_revoked (X-Device-Id names a device kicked after this token's auth_at) · 402 no subscription · 403 member disabled (also when the drop to free disabled this seat) · 404 user gone.