feat(sites): mint a licence for the published sites

The demo and staging sites ran on the free tier, so uploads and the other
licensed features were unavailable to anyone looking at them. The Sites job now
mints a self-contained key pair (site_id 123, the estate's SYSSITE) into the
drive before the snapshot, so both sites are fully usable.

Minted per deploy rather than committed, and the CI estate stays unlicensed so
the specs keep exercising the free tier.

.gitea/workflows/sites.yaml

@@ -113,6 +113,12 @@ jobs:
 
       - name: Build the browser-hosted site
         run: |
+          # The published sites ship a working licence so they are usable beyond
+          # the free tier. It is minted per deploy rather than committed: the
+          # pair is self-contained, and the CI estate stays unlicensed so the
+          # specs can exercise the free tier.
+          node sas/mocks/mint-licence.js "sasjs_root/drive/files$APP_LOC/mock-storage/licence.json"
+
           # DC's data files exist only after makedata has run, so the drive is
           # captured first and shipped as the site's starting drive. services/web9
           # is the streamed frontend, which is already the site itself.