fix(mocks): clear the licence for published sites, not for the estate

Emptying mock-storage/licence.json dropped every CI run to the free tier, where
the upload button is absent, so excel.cy.ts failed all 24 tests: the licensing
spec registers a key only when the activation page is shown, and an unlicensed
estate activates straight into the app.

The placeholder pair stays in the fixture, and the Sites job strips it from the
drive before the snapshot is taken, so the published sites still run unlicensed
without the decrypt-failure page.

.gitea/workflows/sites.yaml

@@ -113,6 +113,11 @@ jobs:
 
       - name: Build the browser-hosted site
         run: |
+          # The estate keeps a placeholder key pair so the licensing specs see the
+          # activation page. A published site runs unlicensed instead, which lands
+          # on the free tier without the decrypt-failure page.
+          printf '{\n  "licenceKey": "",\n  "activationKey": ""\n}\n' > "sasjs_root/drive/files$APP_LOC/mock-storage/licence.json"
+
           # DC's data files exist only after makedata has run, so the drive is
           # captured first and shipped as the site's starting drive. services/web9
           # is the streamed frontend, which is already the site itself.

CONTRIBUTING.md

@@ -135,7 +135,7 @@ After changing mock services, re-run `sasjs cbd -t server-ci` from `sas/mocks/sa
 
 ### Demo and staging sites
 
-A push to `release/**` publishes [staging.datacontroller.io](https://staging.datacontroller.io); a release tag (`v*`, created by the release job after its tests pass) publishes [demo.datacontroller.io](https://demo.datacontroller.io) - workflow file `.gitea/workflows/sites.yaml`, using the `DEMO_DATACONTROLLER_IO` Surfer app password (user `allan`). Both are sites on one multi-site Surfer instance; the demo is its default site. The job builds the mocks as a browser-hosted site (SASjs CLI >= 6.1, `streamConfig.mockWeb`), so the services run in a service worker and the drive lives in the visitor's IndexedDB - there is no server. It runs `makedata` on a throwaway SASjs Server first and ships that drive as `sasjsbuild/mock-snapshot.json`; without it the site opens with no data. The mock ships no licence key, so both sites run on the free tier.
+A push to `release/**` publishes [staging.datacontroller.io](https://staging.datacontroller.io); a release tag (`v*`, created by the release job after its tests pass) publishes [demo.datacontroller.io](https://demo.datacontroller.io) - workflow file `.gitea/workflows/sites.yaml`, using the `DEMO_DATACONTROLLER_IO` Surfer app password (user `allan`). Both are sites on one multi-site Surfer instance; the demo is its default site. The job builds the mocks as a browser-hosted site (SASjs CLI >= 6.1, `streamConfig.mockWeb`), so the services run in a service worker and the drive lives in the visitor's IndexedDB - there is no server. It runs `makedata` on a throwaway SASjs Server first and ships that drive as `sasjsbuild/mock-snapshot.json`; without it the site opens with no data. The published sites run unlicensed - the workflow strips the estate's placeholder key before the drive is captured - so both run on the free tier.
 
 ## GUI Elements
 

sas/mocks/sasjs/mock-storage/licence.json

@@ -1,4 +1,4 @@
 {
-  "licenceKey": "",
-  "activationKey": ""
+  "licenceKey": "invalid",
+  "activationKey": "invalid"
 }