Save in-progress keysat integration and StartOS 0.4 work

Snapshot of the working tree before cleanup. Captures:
- Keysat licensing: server/license.js, /api/license/* endpoints in
  server/index.js, activation modal in public/index.html, embedded
  Ed25519 issuer key (assets/issuer.pub).
- StartOS 0.4 expansion: setApiKey action, version files v0.1.1
  through v0.1.15, file-models/config.json.ts, manifest updates.
- Self-hosted registry server (startos-registry/).
- Build/deploy scripts (bin/bump-version.sh, bin/deploy.sh, vendored
  yt-dlp binary), .gitignore, .deploy.env.example.
- Recent design docs (KEYSAT_INTEGRATION.md, UPGRADE-DESIGN.md) —
  retained here so they remain recoverable when removed in the
  follow-up cleanup commit.

startos-registry/startos-registry.service

@@ -0,0 +1,31 @@
+# /etc/systemd/system/startos-registry.service
+#
+# systemd service for the StartOS registry server.
+# Runs as a dedicated user, auto-restarts on failure.
+
+[Unit]
+Description=StartOS Package Registry Server
+After=network.target
+
+[Service]
+Type=simple
+User=registry
+Group=registry
+WorkingDirectory=/opt/startos-registry
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=5
+Environment=PORT=3030
+Environment=NODE_ENV=production
+
+# Reload packages without restart (updates registry.json + all package.json)
+ExecReload=/bin/kill -HUP $MAINPID
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/opt/startos-registry
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target