legal: close AGPL packaging gaps

Name the copyright holder, ship NOTICE with the image, serve the licence
from the panel footer on every page, and record the vendored htmx licence.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/panel/main.go

@@ -2,6 +2,9 @@
 // several roles (architecture.md § Image and processes) as a supervised
 // process: the HTTP panel server, the journal-milter, the mail.log tailer and
 // the rate-limit checks.
+//
+// Copyright (C) 2026 Mikhail Yenuchenko
+// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (

cmd/selfpost-backup/main.go

@@ -16,6 +16,9 @@
 // the same password:
 //
 //	docker exec -i <container> selfpost-backup -decrypt < backup.spbk > backup.tar.gz
+//
+// Copyright (C) 2026 Mikhail Yenuchenko
+// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (