The licence state for banners

Cluster admins only (`platform.admin`; `hart admin doctor`). Runs the checks now, all at once and each for at most 10 seconds, and answers them in a fixed order: what core can see from its own state: `database` (reachable, migrations applied), `capabilities` (what the cluster offers and how old the probe is), `volume-uid` (workspace volumes owned by another UID than `security.defaultUid`) and `custom-domains` (edge and certificate support). `ok` passed, `warn` works but deserves a look, `fail` is configured and does not work, `skip` does not apply. Then `network-policy` (the last `helm test` probe: policies and `endPort` ranges enforced), `internal-tls` (the in-cluster certificate and its expiry), `mail` (the relay answers), `oidc` (the issuer's discovery document), `backups` (the last dump and archive runs), `jobs` (dead jobs of the last day) and `routers` (connected routers on the current snapshot), in that order after the first four, then `license` (the licence state: `fail` while restricted, `warn` while expiring, in grace, over a limit, or on a test-key licence), `pull-secrets` (the registry pull secrets of the chart value `global.imagePullSecrets` and their copies in the team namespaces: `skip` without them, `fail` while one is missing or of the wrong type, `warn` while a copy is missing) and, since 1.3, the built-in managed services: `managed-images` (the images of Valkey, S3, MariaDB and RabbitMQ are pinned by a digest that resolves: `fail` when a registry says the digest does not exist, `warn` without a digest or when the registry cannot be asked), `managed-storage` (the classes of the enabled services' volumes exist and allow expansion: `warn` otherwise) and `managed-backups` (the backup pods may reach each enabled service's port, `fail` otherwise; `warn` for an instance with backups on whose newest dump is older than 26 hours), then `managed-tls` (the in-cluster TLS of Valkey, MariaDB, RabbitMQ and, since 1.4, S3: `skip` while `internal.tls` is off, `warn` without cert-manager or for a certificate that is not issued or a day past its renewal time), and since 1.4 `managed-storage-write` (a pod with the managed services' security context wrote and read a fresh volume of each class they use: `fail` when a class failed, `warn` while one is not probed yet or could not be judged, `skip` with the probe off; core probes when it becomes the leader, then hourly what is due, and the check reads the last results) and the S3 snapshot backups: `managed-s3-backup-space` (the backup volume's free space against what the newest S3 snapshots reference: `warn` below 1.2 times that, `fail` below a tenth of it) and `managed-s3-blob-gc` (`warn` when the S3 blob GC has not gone through every snapshot directory within 48 hours, never did, or failed in its last run); names are stable. `hart admin doctor` exits 1 when a check fails.