feat(license-validation): add application example with custom field consumption and signature validation

[kriscoleman]

Summary

New example application demonstrating the full lifecycle of consuming custom Replicated license fields and validating their cryptographic signatures:

• Go web dashboard consuming edition tier and seat_count entitlements from the Replicated SDK
• RSA-PSS/SHA-256 signature validation on each license field to detect tampering
• Observable behavioral enforcement: UI theme changes by edition, features gate by tier, seat usage meter with warnings, and feature lockdown on invalid signatures
• Complete Helm chart with Replicated SDK subchart, KOTS integration, preflight checks, and support bundles
• Comprehensive README with 10-step demo walkthrough using Vendor Portal and Compatibility Matrix

Test Plan

• Review app code (app/main.go) for signature validation logic and license field handling
• Verify Helm chart lints and templates render correctly
• Follow README demo walkthrough: set up custom license fields, create release, deploy to CMX cluster, observe theme/feature changes as license fields change
• Test signature validation by changing app public key in KOTS config and verify features lock

[adamancini]

closes #85

[jmboby]

The license-validation Pod can't reach the Replicated SDK service due to DNS

2026/04/01 03:52:09 WARNING: REPLICATED_APP_PUBLIC_KEY not set - signature validation disabled
2026/04/01 03:52:09 License Validation app listening on :8080
2026/04/01 03:52:09 SDK error (license/info): Get "http://license-validation-replicated:3000/api/v1/license/info": dial tcp: lookup license-validation-replicated on 10.43.0.10:53: no such host
2026/04/01 03:52:39 SDK error (license/info): Get "http://license-validation-replicated:3000/api/v1/license/info": dial tcp: lookup license-validation-replicated on 10.43.0.10:53: no such host

# Checking services:
k get svc -n license-validation
NAME                 TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
license-validation   ClusterIP   10.43.199.70   <none>        80/TCP     21m
replicated           ClusterIP   10.43.34.106   <none>        3000/TCP   21m

#This resolves fine within the Pod:

nslookup replicated.license-validation.svc.cluster.local
Server:         10.43.0.10
Address:        10.43.0.10:53

Name:   replicated.license-validation.svc.cluster.local
Address: 10.43.34.106

But not license-validation-replicated, we need to change this in your Go app?

[kriscoleman]

looks like I need to circle back to this one, going to keep this in draft mode until it's ready

[kriscoleman]

@jmboby gave me some great feedback:

The current docker:build target doesn't include the ttl.sh container registry, so that would only work for local dev, does it make sense to include the registry as a var and include this in the build?

I realise it's after hours for you so no need to reply but I'm thinking this Helm helper is redundant since the replicated SDK service name is always 'replicated' regardless of your helm release name? Happy to be wrong however

{{/*
Replicated SDK address - auto-detect from release name if not explicitly set.
*/}}
{{- define "license-validation.sdkAddress" -}}
{{- if .Values.replicatedSDKAddress }}
{{- .Values.replicatedSDKAddress }}
{{- else }}
{{- printf "http://%s-replicated:3000" .Release.Name }}
{{- end }}
{{- end }}