feat: alle lizenzen auflisten - GET /api/v1/licenses (+ ?email= filter)

- Neuer admin-endpunkt GET /api/v1/licenses listet alle lizenzen inkl. email,
  status, max_activations, activations_used, produkt, daten.
- Optionaler ?email=<adresse> filter (case-insensitive) fuer eine kundenmail.
- Integrationstest-abdeckung ergaenzt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

license-backend/test/integration.mjs

@@ -142,6 +142,18 @@ try {
   const info = await admin('GET', `/api/v1/licenses/${key1}`);
   ok('inspect shows 1 domain (kunde-b)', info.json.activations_used === 1 && info.json.domains[0].domain === 'kunde-b.de', JSON.stringify(info.json));
 
+  // List all licenses (each row carries its email)
+  const listAll = await admin('GET', '/api/v1/licenses');
+  ok('list licenses ok', listAll.status === 200 && listAll.json.ok && Array.isArray(listAll.json.licenses), JSON.stringify(listAll.json));
+  ok('list includes key1 with email', listAll.json.licenses.some((l) => l.key === key1 && l.email === 'a@b.de'), JSON.stringify(listAll.json));
+  ok('list rows have activations_used', listAll.json.licenses.every((l) => typeof l.activations_used === 'number'));
+
+  // Filter by email (case-insensitive)
+  const byMail = await admin('GET', '/api/v1/licenses?email=A@B.de');
+  ok('filter by email finds key1', byMail.json.ok && byMail.json.licenses.length === 1 && byMail.json.licenses[0].key === key1, JSON.stringify(byMail.json));
+  const byMailNone = await admin('GET', '/api/v1/licenses?email=nobody@x.de');
+  ok('filter by unknown email → empty', byMailNone.json.ok && byMailNone.json.count === 0, JSON.stringify(byMailNone.json));
+
   // ── Scan endpoint guards ──
   // Unactivated domain → 403
   const scanUnbound = await pub('/api/v1/scan', { key: key1, product: P, domain: 'kunde-a.de' });