security: add dependency license compliance check to CI

## Problem

There is no automated check for dependency license compliance. The project uses 474 packages (per `npm audit`), and while none have known vulnerabilities, their licenses aren't verified.

## Why It Matters

- **Legal risk**: Accidentally including a copyleft dependency (GPL, AGPL) could force the project to change its license
- **Corporate adoption**: Companies that want to self-host MiniSearch need assurance about dependency licenses
- **Transparency**: Users should know what licenses their software includes

## Current State

- Project license: Apache-2.0 (permissive)
- No license compliance tooling
- No license report in CI or release process

## Proposed Solution

Add a license compliance check to CI using one of these tools:

### Option 1: `license-checker` (npm)

```bash
npm install --save-dev license-checker
npx license-checker --production --csv > licenses.csv
```

Then add a CI step that verifies all licenses are compatible with Apache-2.0.

### Option 2: `osv-scanner` (Google)

```bash
osv-scanner --lockfile package-lock.json
```

This checks for vulnerabilities and can be extended to check licenses.

### Option 3: `foya` or `clearlydefined`

More comprehensive license compliance tools.

## Acceptable Licenses

For an Apache-2.0 project, these licenses are generally compatible:

- **Permissive**: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0
- **Weak copyleft**: LGPL-2.1, LGPL-3.0 (with dynamic linking)
- **Not acceptable**: GPL-2.0, GPL-3.0, AGPL-3.0, SSPL

## Files to Change

- `.github/workflows/ci.yml` (add license check step)
- `package.json` (add license-checker as devDependency)
- New: `LICENSES.md` or `licenses.csv` (generated report)

## Acceptance Criteria

- License compliance check runs in CI
- All production dependencies use Apache-2.0-compatible licenses
- A license report is generated and committed (or attached to releases)
- CI fails if an incompatible license is detected

Start with .github/workflows/ci.yml and package.json, then compare the proposed license-compliance tools against the project's production dependency list. Done means CI checks dependency licenses, produces the requested report, and fails when an incompatible license is detected.

Written by the indexing model from the issue text.