Implement Lemon Squeezy webhook and license validation API

[honor2030]

Goal

Make the paid unlock work end-to-end with Lemon Squeezy.

Acceptance criteria

• A valid paid license unlocks Pro features.
• An invalid or revoked key does not unlock the app.
• Webhook and validation flows are testable in development.

Task list

• Implement webhook handler (Next.js API route).
• Implement license validation endpoint.
• Document required environment variables (LEMONSQUEEZY_WEBHOOK_SECRET, etc.).
• Test happy path and invalid-key path.

---

Estimate: 0.5–1 day