API — releases and license sync

All endpoints are versioned and additive; v1 will not change shape.

GET /api/v1/updates/check

Query: version, edition, channel (stable|beta). Optional header X-Janus-Instance. No auth. Returns latest release for the channel.

GET /api/v1/releases

Public list of releases (version, channel, published, notes_url, advisory, min_supported, image_digest). Feeds the changelog.

POST /api/v1/license/sync

Header: Authorization: Bearer <license_id>.<sync_token> (embedded in online keys). Body: {"instance_id","site","version","seats_used","nodes"}. Returns {"license": "<signed key>", "status": "active|grace|expired|revoked", "renews": "<date>"}. The gateway installs the returned key if it is newer than the one on disk.

GET /api/v1/license/pubkeys

Current and previous license public keys, informational. The gateway embeds these at build time and does not fetch them.