init

docs/ARCHITECTURE.md

@@ -0,0 +1,23 @@
+# Architecture
+
+```text
+Product + Go SDK
+  ├─ local Ed25519 license verification
+  ├─ feature/limit gates
+  ├─ signed lease cache (hybrid offline)
+  └─ POST /api/v1/licenses/validate
+              │
+              ▼
+License Platform
+  ├─ Admin / Management portal
+  ├─ Reseller / Author portal
+  ├─ Customer / Client portal
+  ├─ encrypted issuer + lease key vault
+  ├─ encrypted license-token registry
+  ├─ revocation and lease service
+  └─ audit trail / role isolation
+```
+
+The issuer key signs long-lived product licenses. The lease key signs short-lived runtime confirmations. Clients embed only public keys. The management UI never returns either private key.
+
+The platform intentionally uses a `Store` boundary. The included JSON implementation is safe for one process and atomic file replacement. A database implementation can preserve the portal and API layers while adding transactions, replication and tenant indexing.

docs/MIGRATION.md

@@ -0,0 +1,14 @@
+# Migration from the embedded reference server
+
+1. Deploy the standalone platform with a persistent data volume, a new `LICENSE_MASTER_KEY`, and bootstrap credentials.
+2. Sign in as administrator.
+3. In **Schlüsselverwaltung**, open **Bestehende Schlüsselpaare sicher importieren** and provide the existing issuer and lease private keys plus their original key IDs. This action is write-once.
+4. Download `GET /api/v1/trust-store` and update the public trust store embedded in each product build.
+5. Register existing, still-valid license tokens through one of these routes:
+   - `POST /api/v1/licenses/import` with `{"token":"...","customerUserId":"optional"}`;
+   - legacy-compatible `POST /v1/admin/licenses` with `{"token":"..."}`;
+   - the existing local `licenseweb`, pointed at the new platform URL and management bearer token.
+6. Set `LICENSE_PUBLIC_URL` to the stable external HTTPS URL. Newly issued hybrid/online licenses will contain this URL as a signed claim.
+7. Existing licenses without `verification.serverUrl` continue to work when clients receive `LICENSE_SERVER_URL` or well-known discovery.
+
+Do not generate new keys when migrating existing licenses. A new issuer key would make old tokens unverifiable unless both old and new public keys are retained in the product trust store.