feat(studio): show a source module's data terms before the install button

The store detail sheet now carries a data-source block for source.*
modules: publisher, upstream url, the terms in plain words, and any
attribution the operator has to carry with the output. It sits above
maintainers and above the install button, because it is a decision
input rather than a footnote.

The values are selectable: compliance notes get written by copying,
not retyping. A note names whose terms these are, so nobody reads them
as the module's own licence. Four guards, including that an empty
attribution renders no empty row.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/hub.dart

@@ -983,6 +983,14 @@ class HubService {
             canonicalCategoryLabel: e.canonicalCategoryLabel,
             installVerification: e.installVerification,
             maintainers: e.maintainers,
+            dataSource: e.hasDataSource()
+                ? DataProvenance(
+                    name: e.dataSource.name,
+                    url: e.dataSource.url,
+                    license: e.dataSource.license,
+                    attribution: e.dataSource.attribution,
+                  )
+                : null,
           ),
         )
         .toList();
@@ -2454,6 +2462,11 @@ class StoreItem {
   /// any — the detail sheet renders an honest "not specified".
   final List<String> maintainers;
 
+  /// Where a `source.*` module's data comes from, and under what
+  /// terms. Null for every other module: the module's own licence
+  /// covers its code, this covers material it reaches at runtime.
+  final DataProvenance? dataSource;
+
   /// How an install of this entry would be verified under the
   /// hub's CURRENT policy — computed hub-side with the same
   /// resolvers the install gate enforces, so this can never
@@ -2496,5 +2509,30 @@ class StoreItem {
     this.canonicalCategoryLabel = '',
     this.installVerification = '',
     this.maintainers = const [],
+    this.dataSource,
+  });
+}
+
+/// Provenance of the material a source module fetches.
+class DataProvenance {
+  /// Publisher, as a person would name it.
+  final String name;
+
+  /// Canonical URL of the upstream source.
+  final String url;
+
+  /// Terms in plain words, not SPDX: statutes carry no software
+  /// licence at all.
+  final String license;
+
+  /// Attribution the operator must carry with the output; empty when
+  /// the upstream requires none.
+  final String attribution;
+
+  const DataProvenance({
+    required this.name,
+    required this.url,
+    required this.license,
+    required this.attribution,
   });
 }