feat: add agor-pro commercial plugin crate and dual-repo infrastructure

agor-pro Tauri 2.x plugin (feature-gated via --features pro),
commercial Tauri config overlay, asymmetric test setup,
CI workflows (leak-check, commercial-build, PAT health),
pre-push hook, Makefile, CONTRIBUTING/MAINTENANCE/LICENSE-COMMERCIAL.

.github/workflows/commercial-build.yml

@@ -0,0 +1,71 @@
+name: Commercial Build
+
+on:
+  push:
+    branches:
+      - 'commercial/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  commercial-build:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            build-essential \
+            pkg-config
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-pro-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-pro-
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Cargo check (pro features)
+        run: cargo check --features pro
+
+      - name: Cargo test (pro features)
+        run: cargo test --features pro
+
+      - name: Vitest (frontend)
+        run: npm run test
+
+      - name: Commercial tests
+        run: |
+          if [ -d "tests/commercial/" ] && ls tests/commercial/*.test.* 2>/dev/null; then
+            npx vitest run tests/commercial/
+          else
+            echo "No commercial tests found, skipping."
+          fi

.github/workflows/leak-check.yml

@@ -0,0 +1,69 @@
+name: Leak Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  leak-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for commercial directories
+        run: |
+          failed=0
+
+          # Check agor-pro/ exists
+          if [ -d "agor-pro/" ]; then
+            echo "::error::Commercial directory 'agor-pro/' found in community repo"
+            failed=1
+          fi
+
+          # Check src/lib/commercial/ has actual content (beyond .gitkeep)
+          if [ -d "src/lib/commercial/" ]; then
+            content_count=$(find src/lib/commercial/ -type f ! -name '.gitkeep' | wc -l)
+            if [ "$content_count" -gt 0 ]; then
+              echo "::error::Commercial code found in 'src/lib/commercial/' ($content_count files beyond .gitkeep)"
+              find src/lib/commercial/ -type f ! -name '.gitkeep'
+              failed=1
+            fi
+          fi
+
+          # Check tests/commercial/ has actual content (beyond .gitkeep)
+          if [ -d "tests/commercial/" ]; then
+            content_count=$(find tests/commercial/ -type f ! -name '.gitkeep' | wc -l)
+            if [ "$content_count" -gt 0 ]; then
+              echo "::error::Commercial test code found in 'tests/commercial/' ($content_count files beyond .gitkeep)"
+              find tests/commercial/ -type f ! -name '.gitkeep'
+              failed=1
+            fi
+          fi
+
+          if [ "$failed" -eq 1 ]; then
+            exit 1
+          fi
+          echo "No commercial directories with content found."
+
+      - name: Grep for commercial references in source
+        run: |
+          failed=0
+
+          for pattern in "LicenseRef-Commercial" "agor-pro" "agor_pro"; do
+            if grep -r --include="*.ts" --include="*.svelte" --include="*.rs" --include="*.toml" \
+                "$pattern" src/ src-tauri/src/ 2>/dev/null; then
+              echo "::error::Found '$pattern' reference in source code"
+              failed=1
+            fi
+          done
+
+          if [ "$failed" -eq 1 ]; then
+            echo "::error::Commercial references detected in community source. See above for details."
+            exit 1
+          fi
+          echo "No commercial references found in source."

.github/workflows/pat-health.yml

@@ -0,0 +1,75 @@
+name: PAT Health Check
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 9am UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check-pat:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check COMMUNITY_PAT validity
+        env:
+          COMMUNITY_PAT: ${{ secrets.COMMUNITY_PAT }}
+        run: |
+          if [ -z "$COMMUNITY_PAT" ]; then
+            echo "::error::COMMUNITY_PAT secret is not set"
+            echo "pat_valid=false" >> "$GITHUB_ENV"
+            exit 0
+          fi
+
+          status=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token $COMMUNITY_PAT" \
+            -H "Accept: application/vnd.github+json" \
+            https://api.github.com/user)
+
+          if [ "$status" -eq 200 ]; then
+            echo "COMMUNITY_PAT is valid (HTTP $status)"
+            echo "pat_valid=true" >> "$GITHUB_ENV"
+          else
+            echo "::error::COMMUNITY_PAT returned HTTP $status"
+            echo "pat_valid=false" >> "$GITHUB_ENV"
+          fi
+
+      - name: Create issue if PAT is invalid
+        if: env.pat_valid == 'false'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = 'COMMUNITY_PAT is invalid or missing';
+            const body = [
+              '## PAT Health Check Failed',
+              '',
+              'The weekly PAT health check detected that `COMMUNITY_PAT` is either missing or returning an error from the GitHub API.',
+              '',
+              '**Action required:** Rotate or re-create the PAT and update the repository secret.',
+              '',
+              `Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            ].join('\n');
+
+            // Avoid duplicate issues
+            const existing = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'pat-health',
+              per_page: 1,
+            });
+
+            if (existing.data.length > 0) {
+              console.log('Open PAT health issue already exists, skipping creation.');
+              return;
+            }
+
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title,
+              body,
+              labels: ['pat-health'],
+            });