feat(licence): contributed manifests are CC0 1.0

Contributed manifests were in no declared condition at all, which left §9a
replication with no grant flowing through it: peers mirror each other's
catalogues wholesale, and every hop of that was unlicensed.

CC0 rather than a share-alike licence, because a share-alike works by asserting
a right in the data and then conditioning its use. The position in
docs/legal-posture.md §3 is that presence timings are facts rather than
protectable expression — asserting copyright in them in order to license them
would contradict that argument in the same repository, and that contradiction is
worth more to an opponent than the licence is worth to us. CC0 also waives the
sui generis database right by name, closing the EU-specific residual exposure
from the contributor's side.

The grant is taken at token issuance, and that is not incidental. There are no
accounts, so there is no sign-up to attach terms to, and a manifest arrives over
POST /manifests with no channel to negotiate over. Acquiring the contribute
capability is the only moment a grant can be made, so POST /tokens now returns
the licence and its terms alongside the token — a licence the server publishes
but never delivers is one no contributor agreed to.

The test pins the scope limit as well as the identifier. Bounding the grant to
the manifest is the half that can fail silently: a reworded term reading onto
the underlying work would purport to grant what no contributor can.

Also records the settled code-licence position across all four repositories in
the legal posture, correcting an earlier claim there that the plugin and
extraction repos declared nothing. Both already carried LICENSE files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: UR-019 | PR-006

SPEC.md

@@ -951,6 +951,54 @@ this spec, not alongside it: every claim in it is a consequence of a design
 property recorded here, so **a change that weakens `SR-004` or `SR-005` silently
 invalidates it.** Its §7 is the list of changes that would.
 
+---
+
+## 5b. The licence contributed manifests carry — UR-019
+
+**Contributed manifests are CC0 1.0 Universal.** The full text is
+[`LICENSE-DATA`](LICENSE-DATA); the code is separately `GPL-3.0-or-later`, and
+the two must not be conflated — the code licence says nothing about the data,
+and the data is the part that replicates between instances.
+
+This follows the practice of every comparable service (MusicBrainz core data and
+AcousticBrainz are CC0; AcoustID is CC BY-SA), and it closes a gap rather than
+adding a feature: until it was stated, contributed manifests were in no declared
+condition at all, and §9a replication had no grant flowing through it.
+
+**Why CC0 and not a share-alike licence.** A share-alike licence works by
+*asserting* a right in the data and then conditioning its use. The position
+throughout — [`docs/legal-posture.md`](docs/legal-posture.md) §3 — is that
+presence timings are facts rather than protectable expression. Asserting
+copyright in them in order to license them would contradict that argument in the
+same repository, and that contradiction is worth more to an opponent than a
+share-alike licence is worth to the project. CC0 asserts nothing, which is the
+position actually taken.
+
+Two further consequences, both load-bearing:
+
+- **CC0 waives the sui generis database right by name**, not merely copyright.
+  That closes the EU-specific residual exposure from the contributor's side, in
+  the one jurisdiction where such a right exists to be waived.
+- **Federation needs no per-peer negotiation.** §9a has independent operators
+  replicating each other's catalogues wholesale; without a grant reaching every
+  peer, each hop is unlicensed. CC0 makes each one a non-event, and means no
+  instance can become a chokepoint by withholding permission to mirror.
+
+**The grant is taken at token issuance, and this is not incidental.** There are
+no accounts, so there is no sign-up to attach terms to; and a manifest arrives
+over `POST /manifests` with no channel to negotiate over. Acquiring the
+contribute capability is therefore the only moment at which a grant can be made,
+so `POST /tokens` returns the licence and its terms alongside the token. A
+licence the server publishes but never delivers is one no contributor agreed to.
+
+**Scope, stated precisely and repeated in the terms themselves:** the grant
+covers *the manifest* — timings, identifiers, audio signature. It does not, and
+cannot, license the underlying work, which is not the contributor's to license
+and which this server does not hold. That sentence is the whole of §§1–4 of the
+legal posture restated, and it belongs in the terms in exactly that form.
+
+---
+
 ### Client-side hardening
 
 Independent of the server, because a compromised or hostile server must not be