feat(04-01): curated KL gazetteer + lazy three-environment loader + GPL/ODbL licensing

- kl-gazetteer.json: 30 hand-curated KL-metro landmarks (10 required + 20
  more) with locals' aliases as native data (D-08) — canonical OSM names
  as name, shorthand ('KLCC', 'DUKE', 'Sg Wang') as aliases — plus the
  ODbL-1.0 attribution header traveling inside the JSON (D-06/D-07)
- gazetteer.ts: the three laws — lazy memoized index never at module
  scope (Workers startup, T-04-04), static JSON import surviving
  wrangler/Vite/bare-Node (D-07), zero logging/storage (D-15); aliases
  normalized once at index-build (D-09 symmetry)
- source.ts: the D-03 SearchSource — async search() + synchronous byId()
  (slug-validated, honest null); tiered admission (fuzzy only at sim
  >= 0.72) so 'Kuching'/'Penang' refuse as [] — never a fabricated pin
- index.ts: the named-export public API (no default, subpath+extension
  imports per the @araharah/theme precedent)
- LICENSE: the verbatim GPL-3.0 text (D-04); LICENSES.md: the dual-licence
  note (code GPL-3.0, data ODbL-1.0 + OSM attribution); README: corrected
  licence section + search/ in the layout, four-package table, commands

G1-G11 + L1-L3 green (39/39); typecheck clean; esbuild bundle carries the
suria-klcc marker; wrangler dry-run exits 0; bot + web suites unaffected.

LICENSES.md

@@ -0,0 +1,23 @@
+# Licences
+
+## Code — GPL-3.0
+
+All araharah source code (the `bot/`, `web/`, `theme/`, and `search/` workspaces) is licensed under
+the GNU General Public License v3.0. The full text is in [LICENSE](./LICENSE).
+
+GPL-3.0 is a deliberate project law (D-04): a fork must be able to read, change, and redistribute the
+whole system — including the parts that make it a working navigation product.
+
+## Gazetteer data — ODbL-1.0
+
+`search/src/data/kl-gazetteer.json` (and any index derived from it) is curated from OpenStreetMap
+data and is made available under the Open Database License (ODbL) v1.0:
+<https://opendatacommons.org/licenses/odbl/1-0/>
+
+Attribution: © OpenStreetMap contributors.
+
+The ODbL's share-alike obligation (ODbL §4.4) applies to a Derivative Database: the curated
+gazetteer and any restructured form of it carry the same ODbL notice. The normalizer's index is a
+derived, restructured form of the gazetteer and therefore carries the same notice.
+
+Code and data are separately licensed — ODbL §2.3(a) excludes computer programs from the ODbL.