feat: hardware binding modes, operator management, packaged SDK

- Hardware binding: License.HwBinding (none | fixed | firstActivation).
  firstActivation leaves the license unbound until the first activation,
  which claims the machine; afterwards it behaves like fixed. Legacy rows
  backfilled to fixed when a fingerprint was already set.
- Rebind: POST /panel/licenses/{id}/rebind moves a license to new
  hardware (or releases the binding), deactivating existing activations
  and re-signing a new version; 409 on revoked/expired. Operator or
  company admin. Audited, emits license.rebound.
- Operator management: list, invite, promote and demote operators
  (operator-only), guarding self-demotion and the last operator — until
  now a second operator could only be seeded directly into the database.
- SDK packaging: CertifiEd.Client is now a proper NuGet package (id,
  version, MIT license, README, XML docs, symbols) and gained the
  missing public XML documentation.

CertifiEd.Client.csproj

@@ -1,9 +1,37 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <Description>CertifiEd client SDK: license activation, heartbeats and offline Ed25519 token validation.</Description>
+    <!-- XML docs ship with the package so consumers get IntelliSense. -->
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
   </PropertyGroup>
 
+  <!-- ── NuGet packaging ──────────────────────────────────────────────────── -->
+  <PropertyGroup>
+    <PackageId>CertifiEd.Client</PackageId>
+    <Version>1.0.0</Version>
+    <Authors>Ofarandagon</Authors>
+    <Company>Ofarandagon</Company>
+    <Product>CertifiEd</Product>
+    <Copyright>Copyright © Ofarandagon 2026</Copyright>
+    <PackageTags>licensing;license;ed25519;offline;activation;self-hosted</PackageTags>
+    <PackageProjectUrl>https://git.ofarandagon.tj/Ofarandagon/CertifiEd</PackageProjectUrl>
+    <RepositoryUrl>https://git.ofarandagon.tj/Ofarandagon/CertifiEd</RepositoryUrl>
+    <RepositoryType>git</RepositoryType>
+    <PackageLicenseExpression>MIT</PackageLicenseExpression>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
+    <!-- Symbols for debugging; sources embedded for untracked files. -->
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="README.md" Pack="true" PackagePath="\" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="NSec.Cryptography" Version="25.4.0" />
   </ItemGroup>