Move hardcoded dev licenses to `.env` / GitHub Secrets

# Move hardcoded dev licenses to `.env` / GitHub Secrets

## Problem

Multiple test files contain hardcoded JWT license strings inline. These should be loaded from `process.env` (matching the `DEV_ENTERPRISE_TIER_LICENSE` pattern already used in `scripts/dump-openapi.js`) so that:

- CI pulls them from GitHub Secrets
- Local dev loads them from a `.env` file

## Existing pattern to follow

**`scripts/dump-openapi.js:66`** reads `process.env.DEV_ENTERPRISE_TIER_LICENSE`.
**`.github/workflows/tests.yml:54`** injects the secret:
```yaml
env:
DEV_ENTERPRISE_TIER_LICENSE: ${{ secrets.DEV_ENTERPRISE_TIER_LICENSE }}
```

## Hardcoded licenses found

There are **4 distinct license values** reused across test files (excludes licensing loader/index spec tests that intentionally test invalid/expired/edge-case licenses).

### License A — Enterprise tier (10 users/teams/instances, 6 mqtt)
Suggested env var: `DEV_ENTERPRISE_TIER_LICENSE` (reuse existing)

| File | Line(s) |
|------|---------|
| `test/unit/forge/ee/db/models/mcp_spec.js` | 12 |
| `test/unit/forge/ee/routes/teamBroker/index_spec.js` | 46 |
| `test/unit/forge/ee/routes/teamBroker/3rdPartyBroker_spec.js` | 29 |
| `test/unit/forge/ee/routes/mcp/index_spec.js` | 15 |
| `test/unit/forge/ee/routes/catalogue/index_spec.js` | 15, 419, 475 |
| `test/unit/forge/db/models/Project_spec.js` | 171 |
| `test/unit/forge/db/models/Device_spec.js` | 216 |

### License B — High-limits (150 users, 50 teams/projects, 2 devices)
Suggested env var: `DEV_HIGH_LIMITS_LICENSE`

| File | Line(s) |
|------|---------|
| `test/unit/forge/routes/api/device_spec.js` | 1438, 1550, 2540 |
| `test/unit/forge/db/models/Device_spec.js` | 15 |
| `test/unit/forge/routes/api/rateLimits/rateLimits_spec.js` | 234, 352 |
| `test/unit/forge/routes/api/project_spec.js` | 864, 1048 |

### License C — Medium-limits (5 users, 50 teams/projects/devices)
Suggested env var: `DEV_MEDIUM_LIMITS_LICENSE`

| File | Line(s) |
|------|---------|
| `test/unit/forge/db/models/User_spec.js` | 213 |
| `test/unit/forge/routes/auth/index_spec.js` | 512, 571, 653 |
| `test/unit/forge/routes/api/settings_spec.js` | 240 |
| `test/unit/forge/ee/routes/mfa/index_spec.js` | 9 |

### License D — Licensing spec test licenses (loader + index)
These files test license parsing itself (invalid signatures, expired, wrong issuer, etc). They may need to stay hardcoded since they are the test fixtures *for* the licensing system.

| File | Line(s) | Count |
|------|---------|-------|
| `test/unit/forge/licensing/loader_spec.js` | 13, 32, 46, 57, 70, 75, 79, 84, 104 | 9 |
| `test/unit/forge/licensing/index_spec.js` | 27, 46, 63, 86, 109, 131 | 6 |

## What needs to change

1. **GitHub Secrets** — Add `DEV_HIGH_LIMITS_LICENSE` and `DEV_MEDIUM_LIMITS_LICENSE` (plus any others) to the repo secrets.
2. **`.github/workflows/tests.yml`** — Pass the new secrets as env vars to the backend test job (same pattern as line 54).
3. **Test files (Licenses A/B/C)** — Replace inline strings with `process.env.` reads.
4. **`.env.example`** — Add the new env var names so devs know what to populate locally.
5. **Licensing spec tests (License D)** — Decide: keep hardcoded (they test the license parser itself) or extract too. Recommend keeping hardcoded.

## Files affected: 15 test files + 1 workflow file