OpexFlow is commercially licensed. Enforcement is opt-in per build: when
`license.enabled` is set, the connector validates its Polar license key against the
OpexFlow download/validate worker on startup and refuses to start if the key is invalid.
Disabled by default, so dev and CI builds run unenforced.

## Configure

```yaml
license:
  enabled: true
  server_url: "https://dl-opex-flow.opexcg.com"
  key: "${OPEX_LICENSE_KEY}"
  product: "opex-flow"
  offline_grace_days: 3
```

```bash
export OPEX_LICENSE_KEY=XXXX-XXXX-XXXX-XXXX
./target/release/opex-flow config.yaml
```

## How it works

On first start the connector POSTs `{ key, device_id }` to `/license/activate`, which
binds the key to this host through Polar and returns an `activation_id`. That id is cached
to `license.json` next to the binary, so subsequent starts call `/license/validate` with
the cached activation instead of burning a new slot. The connector's version
(`CARGO_PKG_VERSION`) is sent on each check.

If the worker or Polar is unreachable on revalidation, the connector proceeds under
**offline grace** as long as the last successful check is within `offline_grace_days`.
Past the window, or on any explicit `valid: false`, startup fails with a clear error.
Status is exposed read-only at `GET /api/license/status` (no secrets).

## Dev / CI escape hatch

The bypass is environment-only (never in config, so it can't ship enabled):

```bash
OPEX_LICENSE_SKIP=1 ./target/release/opex-flow config.yaml
```

## Downloads & the worker

Release binaries are served from the download worker (R2-backed):
`GET /latest?platform=linux-aarch64` redirects to the latest artifact, and
`GET /downloads` returns the manifest. Worker scaffolding lives at `apps/landing/`; see
its `README.md` for Polar secret setup and release publishing.