Install paid components (authenticated, entitlement-gated)

[jal-co]

modulora add @user/name must work for purchased components:

• Requires modulora login (cli#6) — token resolves the user.
• New authenticated registry surface: /r/ (or a variant) serves the full files for a paid component only when the caller has an entitlement (purchase row). Server-enforced; anonymous/unentitled → 402/404 with a purchase link (modulora.dev/components/@user/name).
• Digest verification identical to free installs — paid releases publish a digest too.
• info on a paid component without entitlement: show metadata + price + purchase URL, never source.
• License terms: the CLI surfaces the seller's license and records/requires prior agreement (made at purchase — see modulora licensing issue).

Depends on: cli#6 (login), modulora purchase licensing issue.

[jal-co]

Core shipped on feat/install-verify: /r/ now entitlement-gates priced components (buyer or owner; session cookie or CLI bearer token) and 402s otherwise with price + purchase_url; the CLI installs purchased components with full digest verification and prints a clean buy pointer when unentitled. Remaining for this issue: surface the seller's license in info/add output, and install receipts.