Relicense to MIT; record why the original results were fabricated

[TechLuddite]

License: AGPL-3.0 → MIT

At the owner's request. Checked first: every runtime dependency is permissive — React/Recharts MIT, Leaflet BSD-2-Clause, lucide-react ISC, JSZip dual-licensed MIT OR GPL-3.0 (we take the MIT side). Nothing imposes copyleft obligations downstream, so the relicense is clean. Also adds the license field that was missing from package.json.

For the record, since "most open" came up: MIT is the most permissive mainstream license — anyone can take this closed-source and commercial. AGPL was the opposite trade, protecting end users' freedom at the cost of adoption friction. Neither is strictly "more open"; they optimise for different people. (0BSD/Unlicense drop even MIT's keep-the-notice condition, if that's ever the goal.)

Docs: CLAUDE.md and docs/POSTMORTEM.md

The first version of this app was generated, looked professional, and produced confident numbers that were substantially invented. That went unnoticed for months. These files exist so the failure modes aren't repeated — or forgotten.

CLAUDE.md is the operating contract for anyone, human or agent, touching measurement code:

• The single rule — never substitute a value for a measurement that failed — and why it's not a style preference.
• The enforcement mechanism: null + strictNullChecks, and <MetricValue> deliberately having no fallback prop. Plus the two greps that catch regressions.
• A table of what a browser genuinely cannot do (traceroute, read cross-origin status or phase timings, prove a port is open, read the LAN IP) and what to report instead. Half the original bugs came from simulating a capability rather than reporting its absence.
• The traps specific to this codebase: the loosely typed history payload, the Leaflet innerHTML sinks, CSV formula injection, the third-party disclosure contract, silent truncation, and {0 && …} rendering a bare zero.

docs/POSTMORTEM.md is the human-facing record — what was fabricated, and more usefully why review didn't catch it:

1. The failure paths were invisible on a working connection — fabrication only appeared when something broke, which is exactly when nobody looks closely and exactly when a diagnostic matters.
2. any disabled the type checker at the export boundary, hiding six field names that didn't exist.
3. @types/react was missing entirely, so the whole React surface was implicitly any. Adding it and enabling strict produced zero errors — the safety had been available all along, just switched off.
4. Confident presentation outran substance. The gap between how trustworthy the app looked and how trustworthy it was is the actual lesson.

It closes with transferable lessons, since none of this is specific to this project.

Verification

npm run check — strict typecheck clean, 0 lint errors, 84 tests passing. Build succeeds. No source changes in this PR beyond the package.json license field.

---

Generated by Claude Code