feat(hub): enforce license requirement for fleet auto-updates while keeping server upstream check free

tests/test_updates.py

@@ -130,14 +130,14 @@ class TestUpdateSystem(unittest.TestCase):
             f.write(b"WIN_CLIENT_V0360")
         self.update_mgr.register_client_package("windows", dummy_pkg, version="0.3.6.0")
 
-        # 3. Client update check endpoint (Allowed regardless of license)
+        # 3. Client update check endpoint (Unlicensed blocks client auto_update)
         chk_unlicensed = Server.check_client_update(
             client_id="win-client-01",
             os="windows",
             current_version="0.3.5.1"
         )
-        self.assertTrue(chk_unlicensed["update_available"])
-        self.assertEqual(chk_unlicensed["latest_version"], "0.3.6.0")
+        self.assertFalse(chk_unlicensed["update_available"])
+        self.assertIn("not authorized", chk_unlicensed.get("reason", ""))
 
         # 4. Enable auto_update feature flag in license config
         import sqlite3