docs: align package license metadata with source-file notices

## Problem

The package metadata and published PyPI release declare `AGPL-3.0-only`, while eight tracked Python source files state that they may be redistributed under AGPL version 3 "or (at your option) any later version."

This affects current `main` at `c6478aae9ab50a13fc54c0599a0a459396c15b99` and release `0.0.5`.

## Source evidence

- `pyproject.toml` line 5: `license = "AGPL-3.0-only"`
- PyPI 0.0.5 license expression: `AGPL-3.0-only`
- Source headers in `app.py`, `config.py`, `datamodel.py`, `parser.py`, `settings.py`, `__main__.py`, `utils/hash.py`, and `utils/table.py`: "either version 3 of the License, or (at your option) any later version"
- Merged PR #7 explicitly describes changing the package license to `AGPL-3.0-only`, but the source notices retain the broader option.

## Expected behavior

The SPDX/package metadata and per-file notices should express the same licensing choice.

## Impact

Consumers and automated license scanners receive conflicting answers about whether later AGPL versions are permitted for the source files.

## Why there is no PR in this report

Choosing `AGPL-3.0-only` versus `AGPL-3.0-or-later` is a legal/project-owner decision. A contributor should not resolve that intent by changing either the source notices or package metadata without maintainer confirmation.

Start by reviewing pyproject.toml line 5, the license notices in app.py, config.py, datamodel.py, parser.py, settings.py, __main__.py, utils/hash.py, and utils/table.py, and merged PR #7. Ask maintainers to confirm whether AGPL-3.0-only or AGPL-3.0-or-later is intended; done means the package metadata and all source notices consistently express that decision.

Written by the indexing model from the issue text.