sec(license): Ed25519 sigs + production-safe tripwire

Two coupled hardening upgrades.

1. Asymmetric signatures (HMAC → Ed25519)

The previous HMAC scheme used a symmetric secret that any motivated
reverse engineer could pull out of the shipped binary and use to
mint blobs for any tier / name / email. With Ed25519, the binary
ships only the public verification key; the signing key never
leaves the seller's environment, so binary compromise no longer
yields forgery.

- src/license/crypto.py rewritten around
  cryptography.hazmat.primitives.asymmetric.ed25519. Same public
  API surface (sign/verify/encode_blob/decode_blob), same canonical
  JSON encoding — drop-in for the manager / cli / GUI layers.
- DATATOOLS_LICENSE_PRIVKEY (seller-side) and
  DATATOOLS_LICENSE_PUBKEY (build-time) env vars supply the keys;
  the in-source dev keypair (src/license/_dev_keypair.py)
  deterministically derives from a seed phrase for repro builds and
  tests.
- Blob prefix bumped DTLIC1: → DTLIC2:. Decoding a DTLIC1 blob
  surfaces a clear "old format" error rather than a confusing
  signature mismatch.
- scripts/generate_keypair.py mints fresh production keypairs for
  the seller (run once, stash the private key offline). Adds
  cryptography>=41,<46 to requirements.txt (was an undeclared
  transitive dep).

2. Production-safe tripwire

assert_production_safe() refuses to boot a frozen / shipped build
when either:

- DATATOOLS_DEV_MODE=1 is set (would unconditionally bypass every
  license check — fine in source/test but catastrophic in a buyer
  install).
- The active verification key is still the embedded dev key (the
  build pipeline forgot to set DATATOOLS_LICENSE_PUBKEY).

No-op in source / pytest runs (sys.frozen is unset) so test
fixtures and dev workflows keep working without ceremony. Called
from src/cli_license_guard.guard() and from hide_streamlit_chrome
— so it fires on every CLI invocation and every GUI page load.

Tests: 49 license-layer unit tests (was 40); added Ed25519
wrong-key rejection, dev-keypair seed pin, blob v2 prefix, v1
rejection with clear message, and four production-safe scenarios
(no-op in source, fires on DEV_MODE in frozen, fires on dev key in
frozen, passes in frozen with prod pubkey). Total: 2024 → 2033.

Docs (REQUIREMENTS §17a, DEVELOPER licensing recipe, DECISIONS
§9b + decision log) updated with the new threat-model write-up,
key-storage workflow, and tripwire behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/REQUIREMENTS.md

@@ -174,10 +174,11 @@ and proceeds.
 - **Dev**: pytest, tox.
 
 ## 16. Test coverage
-- 2,024 tests passing, 0 skipped, 0 xfailed.
-  - 1,859 core + CLI tests (run with `pytest -m 'not gui'` for a quick loop).
-    Includes 40 license-layer unit tests, 25 license-CLI tests, and
-    17 Lite-tier feature-map + guard tests.
+- 2,033 tests passing, 0 skipped, 0 xfailed.
+  - 1,868 core + CLI tests (run with `pytest -m 'not gui'` for a quick loop).
+    Includes 49 license-layer unit tests (Ed25519 sign/verify, dev-key
+    derivation, production-safe tripwire, schema), 25 license-CLI
+    tests, and 17 Lite-tier feature-map + guard tests.
   - 165 GUI tests under `tests/gui/` driving Streamlit pages via `AppTest`
     (smoke + EN/ES localization, chrome, gate, workflows, dedup review,
     advanced panels, error paths, findings panel, activation +
@@ -194,8 +195,14 @@ and proceeds.
 
 ## 17a. Licensing
 - **Storage**: ``~/.datatools/license.json`` (or
-  ``$DATATOOLS_LICENSE_PATH`` override). Signed locally with
-  HMAC-SHA256.
+  ``$DATATOOLS_LICENSE_PATH`` override). Signed with Ed25519
+  (asymmetric).
+- **Crypto**: Ed25519. The seller holds the private key; every
+  shipped binary embeds only the public key. A motivated reverse
+  engineer who pulls everything out of the binary still can't sign
+  new licenses. Keys are 32 bytes raw, exposed as hex via
+  ``DATATOOLS_LICENSE_PRIVKEY`` (seller-side) and
+  ``DATATOOLS_LICENSE_PUBKEY`` (build-time bake-in).
 - **Activation**: buyer pastes a base64-encoded license blob
   (``DTLIC1:...``) on first launch; app verifies the signature
   offline + matches the buyer-entered name/email to the embedded
@@ -226,10 +233,17 @@ and proceeds.
 - **Lock badge**: the home grid shows a red 🔒 Locked pill on tool
   cards the current tier doesn't unlock.
 - **Dev bypass**: ``DATATOOLS_DEV_MODE=1`` skips every check (used by
-  the test suite and during development).
+  the test suite and during development). **Refused in shipped
+  builds** by the production-safe tripwire.
+- **Production-safe tripwire**: ``assert_production_safe()`` runs at
+  startup in every frozen build. Refuses to boot when ``DEV_MODE``
+  is set or the verification key is still the embedded dev key
+  (i.e., the build pipeline forgot to override
+  ``DATATOOLS_LICENSE_PUBKEY``). No-op in source / pytest runs.
 - **No internet**: signature verification is fully offline. The
-  shipped binary embeds the verification secret; see
-  ``docs/DECISIONS.md`` for the threat-model discussion.
+  shipped binary embeds only the public key; the private key never
+  leaves the seller. See ``docs/DECISIONS.md`` for the threat-model
+  discussion.
 
 ## 18. Error handling
 - Structured hierarchy: `DataToolsError` → `InputValidationError`, `ConfigError`, `FileFormatError`, `FileAccessError`.