feat: LicenseGuard 中间件 + Flutter license model/repo (21D+21E)

21D — 后端:
- Claims 新增 LicenseExpiresAt (*int64 unix 秒)，写入 JWT 避免每次查库
- middleware/license_guard.go: CalcLicensePhase / LicenseGuard / GetLicensePhase
  - grace(0-7d): 允许通行
  - readonly(7-15d): 拦截非 GET 写操作 → 403
  - locked(15d+): 全部拦截 → 403
- auth.go: issueTokens 在 JWT 中嵌入 license expires_at；Login 检查 locked 拒绝登录
- router: license/* 路由豁免 LicenseGuard（锁定时仍可激活/查状态）

21E — Flutter 前端:
- models/license.dart: 新 LicenseInfo，含 phase/maxDevices，去掉旧 activatedAt
- core/device/device_id.dart: 持久化 UUID-v4 作为设备 ID（SharedPreferences）
- repositories/license_repository.dart: getInfo/activate/deactivate，激活时携带设备信息
- providers/license_provider.dart: 改接 LicenseRepository
- settings_screen.dart: activatedAt 改为显示 maxDevices

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/service/auth.go

@@ -18,6 +18,7 @@ import (
 var (
 	ErrInvalidCredentials = errors.New("invalid username or password")
 	ErrUserInactive       = errors.New("user is disabled")
+	ErrLicenseLocked      = errors.New("license locked, please renew or contact support")
 )
 
 type AuthService struct {
@@ -56,6 +57,10 @@ func (s *AuthService) Login(shopCode, username, password string) (*TokenPair, *m
 		return nil, nil, ErrInvalidCredentials
 	}
 
+	if err := s.checkLicenseNotLocked(shop.ID); err != nil {
+		return nil, nil, err
+	}
+
 	pair, err := s.issueTokens(user.ID, shop.ID, user.Role)
 	if err != nil {
 		return nil, nil, err
@@ -153,15 +158,37 @@ func (s *AuthService) RefreshTokens(refreshToken string) (*TokenPair, error) {
 	return s.issueTokens(claims.UserID, claims.ShopID, claims.Role)
 }
 
+func (s *AuthService) checkLicenseNotLocked(shopID uint64) error {
+	var lic model.License
+	if err := s.db.Where("shop_id = ? AND is_active = 1", shopID).
+		Order("id DESC").First(&lic).Error; err != nil {
+		return nil // no license record → allow login
+	}
+	if middleware.CalcLicensePhase(lic.ExpiresAt) == middleware.PhaseLocked {
+		return ErrLicenseLocked
+	}
+	return nil
+}
+
 func (s *AuthService) issueTokens(userID, shopID uint64, role string) (*TokenPair, error) {
 	cfg := config.C.JWT
 	now := time.Now()
 
+	// Embed license expires_at in JWT so LicenseGuard can check phase without DB.
+	var licExpAt *int64
+	var lic model.License
+	if err := s.db.Where("shop_id = ? AND is_active = 1", shopID).
+		Order("id DESC").First(&lic).Error; err == nil && lic.ExpiresAt != nil {
+		ts := lic.ExpiresAt.Unix()
+		licExpAt = &ts
+	}
+
 	accessExp := now.Add(time.Duration(cfg.AccessExpireMin) * time.Minute)
 	accessClaims := middleware.Claims{
-		UserID: userID,
-		ShopID: shopID,
-		Role:   role,
+		UserID:           userID,
+		ShopID:           shopID,
+		Role:             role,
+		LicenseExpiresAt: licExpAt,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(accessExp),
 			IssuedAt:  jwt.NewNumericDate(now),
@@ -174,9 +201,10 @@ func (s *AuthService) issueTokens(userID, shopID uint64, role string) (*TokenPai
 
 	refreshExp := now.Add(time.Duration(cfg.RefreshExpireH) * time.Hour)
 	refreshClaims := middleware.Claims{
-		UserID: userID,
-		ShopID: shopID,
-		Role:   role,
+		UserID:           userID,
+		ShopID:           shopID,
+		Role:             role,
+		LicenseExpiresAt: licExpAt,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(refreshExp),
 			IssuedAt:  jwt.NewNumericDate(now),