AGPL §13: a network user must be offered the source, and right now nothing offers it

Picking AGPL-3.0 for #25 creates an obligation in the running product, not only in the repository. It is worth filing separately because it is the part that gets forgotten: the LICENSE file satisfies the repo, and satisfies nothing about the installed machine.

Section 13:

> if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network [...] an opportunity to receive the Corresponding Source

CieloOS is network-facing by design — a company runs it and its people reach it from their laptops. So every user of a modified install is exactly the person §13 is about, and today neither the admin panel nor the portal offers them anything.

## What to build

- A source offer reachable from the UI. "Prominently" does not mean loud: a footer link, or an entry in the panel's about/settings, is the normal reading. It must be reachable without signing in, because a person looking at a sign-in page is already interacting with the program over a network.
- It must point at **this install's** source, including local modifications — not unconditionally at `github.com/egarim/CieloOS`. An operator who patched their copy has to be able to set the URL, so this is a branding/config value with the upstream repo as its default.
- Ship the version or commit the build came from, so the offer names a specific source rather than a moving branch. The release already stamps a version; reuse it.
- The new portal should carry the same link. Cheaper to put in the shell now than to retrofit into four views later.

## Deliberately not in scope

Serving a source tarball from the machine. The licence permits a written offer pointing at where the source can be obtained, and building a tarball endpoint invites shipping one that is stale or incomplete — worse than a link that is honest about what it points to.

Follows #25.

Start at the admin panel and portal entry points, then trace the branding/configuration values and the existing release version stamp. Add a publicly reachable source-offer link using a configurable install-source URL and the specific build version or commit, with the upstream repository as the default. Done means both the admin panel and portal expose the link without sign-in and the link identifies this install's source.

Written by the indexing model from the issue text.