Declare proprietary licensing and enforce permissive-only dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Our own crate and npm
packages carried no licence field, which made `cargo deny` report the
Tauri crate as `unlicensed`.

The Nuxt/Tauri dependency graph audited clean (MIT/Apache/ISC/BSD, plus
BlueOak-1.0.0 - which is why this allow list carries BlueOak where
continuum-cad's did not). Two entries worth knowing, both recorded in
continuum-common's docs/LICENSES.md: `node-forge` is
`(BSD-3-Clause OR GPL-2.0)` and we elect BSD-3-Clause, and
`caniuse-lite` is CC-BY-4.0 build-time data that is not bundled into the
built SPA, so no attribution obligation today.

apps/desktop/package.json

@@ -1,5 +1,6 @@
 {
   "name": "@continuum/desktop",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "type": "module",

apps/desktop/src-tauri/Cargo.toml

@@ -4,6 +4,10 @@ version = "0.1.0"
 description = "Continuum operator console desktop shell"
 edition = "2021"
 rust-version = "1.77"
+# Proprietary: deliberately not an SPDX id, so cargo-deny treats it as
+# first-party. See docs/LICENSES.md in continuum-common.
+license = "LicenseRef-Proprietary"
+publish = false
 
 [build-dependencies]
 tauri-build = { version = "2.0", features = [] }

apps/web/package.json

@@ -1,5 +1,6 @@
 {
   "name": "@continuum/web",
+  "license": "UNLICENSED",
   "private": true,
   "version": "0.1.0",
   "type": "module",