feat(license): datatools-admin CLI for the mint API

New operator CLI at src/admin_cli.py: mint, list, revoke, ping —
talks to the server's /internal/* endpoints over a local SSH tunnel.
Stdlib-only on the desktop side (urllib + typer), no new top-level
deps. Auth via $DATATOOLS_ADMIN_TOKEN.

scripts/generate_license.py is now annotated as a break-glass tool
for when the server is unreachable — routine work goes through the
new CLI so the authoritative `licenses` row is created.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/generate_license.py

@@ -1,5 +1,17 @@
 #!/usr/bin/env python3
-"""Mint a signed license blob for a buyer.
+"""Mint a signed license blob for a buyer (LOCAL, break-glass).
+
+.. warning::
+
+   This script mints **locally**, without going through the license
+   server. Prefer :mod:`src.admin_cli` (``datatools-admin mint``)
+   for routine work — it writes to the authoritative ``licenses``
+   Postgres table and emits the same blob.
+
+   Reach for this script only when the server is unreachable and a
+   buyer needs a license *right now*. Mints from here land in the
+   local issuance JSONL log; you'll need to reconcile them into the
+   server's DB afterwards.
 
 Creator-only tool. Signs with the Ed25519 private key from
 ``$DATATOOLS_LICENSE_PRIVKEY`` (production) or the in-tree dev key