Add SecPal attribution terms to AGPL licensing

[aroviqen]

Goal

Add SecPal attribution terms to AGPL-covered SecPal-owned parts of this repository using the REUSE-compatible LicenseRef-SecPal-Attribution defined by the central policy issue.

Central policy: SecPal/.github#510
Third-party license audit: #314

Scope

• Add LICENSES/LicenseRef-SecPal-Attribution.txt using the final text agreed in Document SecPal licensing, CLA, and attribution policy .github#510.

• Update only AGPL-covered SecPal-owned license expressions:

  AGPL-3.0-or-later
  

  to:

  AGPL-3.0-or-later AND LicenseRef-SecPal-Attribution
  

• Preserve the repository's mixed licensing model, including CC0-1.0, MIT, Apache-2.0, generated files, Android wrapper/Gradle files, and third-party notices.

• Standardize project-owned copyright notices to SecPal Contributors where touched.

• Do not add Tailwind-related terms in this repository.

• Ensure Android app/about/legal surfaces expose the required Powered by SecPal attribution where applicable.

• Treat the tagline and website link as preferred/requested, not mandatory legal conditions.

• Run reuse lint after metadata changes.

Implementation notes

• Do not apply LicenseRef-SecPal-Attribution blindly to every file.
• Do not use this issue to audit or reclassify third-party dependencies; use Audit third-party license compliance and REUSE metadata #314 for that.
• Keep this change limited to SecPal attribution metadata, the required attribution app surface, and directly related documentation.

Acceptance criteria

• LICENSES/LicenseRef-SecPal-Attribution.txt exists.
• AGPL-covered SecPal-owned files/REUSE annotations include LicenseRef-SecPal-Attribution.
• Non-AGPL and third-party license metadata remains unchanged.
• No Tailwind-specific terms are introduced.
• Copyright notices are consistent with SecPal Contributors where touched.
• Android app/about/legal surfaces expose Powered by SecPal where applicable.
• The preferred tagline and website may be shown, but are not treated as mandatory legal conditions.
• reuse lint passes.
• README or relevant legal documentation references the additional attribution terms under AGPLv3 section 7(b)/(c).

[github-actions]

✅ This issue has been added to the SecPal Feature Roadmap with status: 💡 Ideas

New idea - needs discussion and evaluation

Status Flow:
💡 Ideas → 💬 Discussion → 📥 Backlog → 📋 Planned → 🚧 In Progress → 👀 In Review → ✅ Done

Note: Ideas that won't be implemented should be moved to 🚫 Won't Do with a reason.

[aroviqen]

Related central policy/documentation issue: SecPal/.github#510

Sibling implementation issues:

• Add SecPal attribution terms to AGPL licensing api#1219
• Add SecPal attribution terms to AGPL licensing frontend#1316

[aroviqen]

Clarification: Do not apply LicenseRef-SecPal-Attribution blindly to every file.

This issue is limited to AGPL-covered SecPal-owned code/assets. The Android repository has deliberately mixed licensing, and that must stay intact.

Implementation rule:

• AGPL-3.0-or-later → AGPL-3.0-or-later AND LicenseRef-SecPal-Attribution
• CC0-1.0, MIT, Apache-2.0, Android wrapper/Gradle files, generated files, third-party notices, and license-specific entries → leave unchanged unless there is a file-specific reason to change them.