TRZ1.<base64url exact UTF-8 JSON payload>.<base64url detached Ed25519 signature>

The signature covers the original decoded UTF-8 payload bytes exactly.
Do not parse/re-serialize before verifying. Base64url sections omit padding.

Payload:
{v:1,kid:"tirazel-2026",id:UUID,product:"megashop",licensee:string,
 issuedAt:ISO8601,expiresAt:null|ISO8601,installationId?:string,domain?:string}

Verifier checks product, key ID, signature, UUID/owner shape, issue/expiry dates,
and each supplied binding. MegaShop requires a domain binding for its one-domain licence.
Domain matching ignores case, trailing dot, www. and port.
Installation ID is a random per-installation 32-character hexadecimal identifier.
The sole signing private key must remain on the seller's protected issuing system.
The customer package contains only raw32-base64 public keys in app/license-public.php.
