Make the AGPL's source offer point at the source being run

Three things a licence audit turned up. None of them is a conflict --
every one of the 182 installed packages is permissive, and the relicence
was within the copyright holder's gift -- but all three are ways the
AGPL fails to stick.

The offer was hard-coded to this repository. Section 13 asks whoever
runs a modified version to offer *that* version's source, so every
deployment with a patch in it was pointing at the wrong tree, and would
have gone on doing so unless its operator noticed and edited the About
page. SOURCE_URL now sets it, alongside APP_NAME, and both the sign-in
page and About read it.

The offer was also only visible after signing in. Whoever is looking at
the sign-in form is interacting with the program over a network too, so
the footer carries it now.

And the two workspace packages declared no licence at all. Private, so
npm never minded, but anything reading the tree saw a blank where the
rest of the project says AGPL-3.0-or-later.

Checked both ways round: with SOURCE_URL set to a fork, the sign-in page
and About both point at the fork; with it unset, both fall back to this
repository.

server/package.json

@@ -2,6 +2,7 @@
   "name": "@ihasmail/server",
   "version": "2.0.0",
   "private": true,
+  "license": "AGPL-3.0-or-later",
   "type": "module",
   "main": "dist/index.js",
   "scripts": {

server/src/app.ts

@@ -148,6 +148,7 @@ export function createApp(): Hono<Env> {
   api.get("/config", (c) =>
     c.json({
       appName: config.appName,
+      sourceUrl: config.sourceUrl,
       imageProxy: config.imageProxy,
       maxUploadBytes: config.maxUploadBytes,
     }),
@@ -581,6 +582,7 @@ function sessionExtras(session: LiveSession, info: AccountInfo = { locale: null,
   return {
     ihasmail: {
       appName: config.appName,
+      sourceUrl: config.sourceUrl,
       imageProxy: config.imageProxy,
       maxUploadBytes: config.maxUploadBytes,
       sessionId: session.id,

server/src/config.ts

@@ -60,6 +60,14 @@ const stalwartUrl = env("STALWART_URL", "https://mail.example.com").replace(/\/+
 export const config = {
   isProd,
   appName: env("APP_NAME", "ihasmail"),
+  /**
+   * Where this instance's source can be had, shown to everyone who reaches it.
+   *
+   * The AGPL asks whoever *runs* a modified version to offer that version's
+   * source, not the one it was forked from -- so anyone deploying a patched
+   * ihasmail should point this at their own tree.
+   */
+  sourceUrl: env("SOURCE_URL", "https://github.com/LINUXexpert-org/ihasmail"),
   host: env("HOST", "0.0.0.0"),
   port: int("PORT", 8080),
   stalwartUrl,