License the project; add root README, website, and parked release CI

- Code: GPL-3.0-or-later (LICENSE, SPDX headers on all .kt/.aidl).
  Specs in docs/: CC-BY-4.0 (docs/LICENSE). Rationale in build-status.md;
  server decided GPL (not AGPL).
- Root README for the public repo.
- web/: Cloudflare Worker site for echo-lot.app. /apk resolves the newest
  APK from the Gitea latest-release API at request time (edge-cached 5 min),
  so tagging a release is the only publish step. /fdroid, /source, and a
  manual DOWNLOAD_URL fallback are wrangler vars.
- .gitea/workflows/release.yml: tag-driven (v*) signed semver APK builds for
  the future production app in echolot-app/. Parked; the prober is
  deliberately not CI-built.
- Fix UserService.kt: drop the explicit secondary constructor that
  conflicted with the implicit primary (never compiled before — first
  local build caught it). Prober now builds: :app:assembleDebug OK.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -7,7 +7,15 @@ Last updated: 2026-07-29.
   (hyphen→underscore; appIds/packages can't contain hyphens). Prober appId `app.echo_lot.prober`.
 - Stack: native **Kotlin + Jetpack Compose**, no Flutter.
 - Tiers: `app` (no root), **`shizuku` in v1** (wireless-ADB pairing), `root` future.
-- License: still undecided (GPLv3 vs Apache-2.0) — needed before repos go public.
+- **License (decided 2026-07-30):** all code **GPL-3.0-or-later**; the specs in `docs/` **CC-BY-4.0**.
+  Rationale: the moat is the no-root platform research, which is trivially liftable into a
+  proprietary repackage — copyleft is the only option that prevents that, and the F-Droid /
+  network-engineer audience reads GPL as a trust signal rather than friction. The specs go
+  permissive on purpose: a wire protocol only becomes a standard if anyone can implement it.
+  **Not AGPL for the server** — the ASP loophole it closes is speculative here, while blanket
+  corporate AGPL bans would hit exactly the enterprise network teams most likely to self-host.
+  Sole copyright holder, so relicensing the server to AGPL later stays possible.
+  Open: substitute a real legal copyright holder for "Echolot contributors" in the SPDX headers.
 
 ## Specs (in `docs/`, alongside this file)
 - `feature-catalog-and-feasibility.md`, `measurement-schema.md`, `probe-protocol.md`. Considered draft-complete and reviewed by the user.