Re-verify a Cloud licence when the licence site reports a change - #1561

Closes #1560

What and why

A plan change made in the Stripe billing portal reached a Cloud workspace only at its next daily re-verification. On 6 Nov 2026 a Team upgrade kept Starter limits on Cloud while the licence site already had it on Team: the licence page refresh is throttled to once a minute, and the customer came back from the portal within that minute.

• POST /api/license/sync { licenseKey }: accepts only the licence site's service token (x-amcp-service-token, timing-safe compare against LICENSE_SERVICE_TOKEN) and re-verifies that key. It carries no licence data, so a forged call can at worst cause one extra check. 404 on self-hosted, without the token or with a wrong one. Only keys bound to a workspace are verified; concurrent calls for one key verify once. Excluded from Swagger.
• Opening the billing portal resets the refresh throttle, so the return visit always refreshes.

The licence site calls the endpoint from its Stripe webhook (HelpCode-ai/anythingmcp-website, linked PR).

Deployment modes

• Cloud: changes reach the workspace within seconds of the Stripe event; the daily re-verification stays as the fallback.
• Self-hosted: no behaviour change (the endpoint answers 404).

Tests

In packages/backend (after npx prisma generate):

• npx jest src/license --maxWorkers=4 → 15 suites, 281 tests passed (new: controller token checks, sync service, portal throttle reset)
• npx tsc --noEmit -p tsconfig.json → no errors
• npx eslint on the four changed files → no findings