refactor(backend): collapse entitlement provider abstraction back to LicenseService (#889)

Removes backend/src/entitlements/ (registry, loadProvider,
CommunityEntitlementProvider, types, headers, normalize) and the two
abstraction-only tests. Relocates headers/normalize/types to
services/license-*.ts. Swaps 22 consumer call sites from
getEntitlementProvider() to LicenseService.getInstance(). Drops the
Dockerfile install step plus PRO_PACKAGE_VERSION build-arg and
github_token BuildKit secret in docker-publish.yml. Removes the now
stale no-restricted-imports rule in backend/eslint.config.mjs.

Net: 37 files changed, ~700 lines removed, no behavior change. Local
dev no longer requires GitHub Packages auth to start the backend.

Rationale and revisit conditions in
docs/internal/adrs/2026-05-02-collapse-entitlement-provider.md.

backend/src/__tests__/scheduler-service.test.ts

@@ -98,15 +98,6 @@ vi.mock('../services/LicenseService', () => ({
   },
 }));
 
-// SchedulerService now talks to the entitlement registry rather than
-// LicenseService.getInstance() directly. Mock the registry to return the
-// same shape the test was already mocking on LicenseService.
-vi.mock('../entitlements/registry', () => ({
-  getEntitlementProvider: () => ({
-    getTier: mockGetTier,
-    getVariant: mockGetVariant,
-  }),
-}));
 
 vi.mock('../services/DockerController', () => ({
   default: {