Update licensing to AGPL-3.0-only

[bjcorder]

Summary

• replace the MIT license text with the GNU AGPL v3 license text and declare AGPL-3.0-only in npm metadata
• add a confirmatory SecFlow CLA, contributing guidance, and PR checklist language for CLA acceptance
• add SPDX AGPL-3.0-only headers to TypeScript source and test files
• document AGPL network-source obligations in the README

Verification

• npm.cmd run typecheck
• npm.cmd run build
• npm.cmd test (first run hit a transient TUI interaction timeout; rerun passed 29/29)