feat(ci): add dependency license check and attributions

[usmanimamu17-create]

Summary

Adds a production-scoped dependency license check to the audit workflow, an allowlist + documented exception process, and an in-app Open Source Licenses screen rendering a generated attribution file. The in-app auditor's stale license blacklist is reconciled to the same allowlist so the merge gate and the auditor agree.

Closes #1031.
Closes #1028

Closes #1029

Closes #1030

Type of Change

• New feature (non-breaking change which adds functionality)

What was done

• License scan (AC: disallowed license fails CI) — scripts/license-audit.js scans the transitive production dependency tree via license-checker --production and fails on any package whose license is not allowlisted unless it has an approved exception. Wired into .github/workflows/audit.yml as npm run license:check.
• Allowlist + exception process (AC: documented) — license-allowlist.json (permissive/store-safe licenses; excludes GPL/AGPL/SSPL/LGPL/CC-BY-SA) and license-exceptions.json (per-package approvals) with the review process documented in scripts/README.md -> Dependency Licensing. UNKNOWN/missing licenses are never allowed.
• Attribution file + in-app display (AC: app displays attributions) — npm run attribution generates assets/THIRD_PARTY_NOTICES.json from the full production tree. New /licenses route (app/licenses.tsx) renders src/components/mobile/LicensesScreen.tsx, reachable via a new Open Source Licenses row under Settings → App in MobileSettings.tsx. A committed baseline snapshot (66 direct production deps) is included so the screen works without a build step; CI regenerates the authoritative full tree.
• Reconcile NetworkAnalyzer — checkLicenseCompliance in src/audit/analyzers/NetworkAnalyzer.ts no longer uses a hard-coded blacklist; it reads the same license-allowlist.json + license-exceptions.json over the production-only scope (was prod+dev). Report shape (licenseCompliance: [] in tests) is unchanged.

Acceptance Criteria

• A disallowed license fails CI — new license:check step in audit.yml, exits non-zero on any non-allowlisted/unexcepted license.
• The allowlist and exception process are documented — scripts/README.md -> Dependency Licensing.
• The app displays third-party attributions — /licenses screen reachable from Settings → App.

Testing Done

• Manual Verification — scripts/license-audit.js passes node --check; package.json, license-allowlist.json, license-exceptions.json, and assets/THIRD_PARTY_NOTICES.json all parse; generated baseline contains 66 direct production deps.
• Unit Tests — N/A beyond existing (report shape unchanged, licenseCompliance: [] tests still valid).
• The license:check gate itself was NOT executed here: license-checker requires node_modules, which is not installed on this machine at PR creation time, and CI is not yet green on this repo. The script and NetworkAnalyzer matcher handle AND/OR expressions and read the exact same policy files.

Security Considerations

• No user data or tokens in these changes; licenses are metadata only.
• No token exposure in logs.
• Input validation — N/A.
• Deep link safety — new /licenses route only renders local attribution data (no user-supplied input).

Performance Considerations

• FlatList used in LicensesScreen for attribution rows (keyExtractor provided).
• Hook optimization — N/A minimal.
• Async patterns — N/A.
• Bundle size — license-checker is a devDependency (not bundled); the attribution screen reads a static JSON snapshot (no runtime network).

Checklist

• I have read the CONTRIBUTING guide.
• My code follows the style guidelines of this project.
• I have updated the documentation accordingly (scripts/README.md, in-app notices).
• No ADR needed for this operational/CI addition; behavior is config-driven via the allowlist files.

[drips-wave]

@usmanimamu17-create Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.