chore(license): align all license declarations with Apache-2.0 LICENSE

[arpan-mondal]

What

License consistency pass. The repository's LICENSE file is Apache 2.0, but several package manifests and docs still declared the project as MIT-licensed. This PR aligns every license declaration with the actual LICENSE file.

No legal change. LICENSE was already Apache 2.0 and is unmodified by this PR. The MIT references were a documentation/metadata bug.

Why

Audit found six places out of sync with the canonical LICENSE file:

File	Before	After
package.json (root npm bootstrapper)	"license": "MIT"	"license": "Apache-2.0"
sdk/js/package.json	"license": "MIT"	"license": "Apache-2.0"
sdk/python/pyproject.toml	license = {text = "MIT"} + MIT classifier	Apache-2.0 + Apache classifier
CONTRIBUTING.md:3	"StacyVM is MIT-licensed"	"StacyVM is Apache 2.0-licensed"
CONTRIBUTING.md:363	"licensed under MIT"	"licensed under Apache 2.0"
sdk/js/README.md License section	"MIT — see LICENSE"	"Apache 2.0 — see LICENSE"
sdk/python/README.md License section	"MIT — see LICENSE"	"Apache 2.0 — see LICENSE"

This matters more than typical doc drift because:

1. pyproject.toml drives the PyPI metadata. A stacyvm package published with the wrong license field and OSI classifier misrepresents the legal terms to downstream installers.
2. package.json drives the npm registry metadata for both the root bootstrapper (stacyvm-setup) and the JS SDK. Same misrepresentation risk.
3. CONTRIBUTING.md:363 told contributors their PRs were licensed under MIT, while the actual project license is Apache 2.0. Anyone who relied on that statement could plausibly claim they intended a different licensing posture.

What this PR does NOT do

• Does not touch LICENSE. It was already Apache 2.0.
• Does not touch the vendored Foundry/forge-std library under images/evm/contracts/lib/forge-std/. That code is genuinely MIT-licensed by its upstream authors (Foundry team) and is correctly marked as such. Changing it would be misrepresentation of third-party code.
• Does not touch source-code substrings like RATE_LIMIT, RESOURCE_LIMIT, SQL LIMIT, or HISTORY_LIMIT — those are not license-related.

Diff size

6 files, +8 / -8 lines. Mechanical text/JSON/TOML edits, no logic changes.

Verification

After this PR, the only files in the tree containing the literal string MIT in a license context are under images/evm/contracts/lib/forge-std/ (vendored, correct).

Review focus

• Are there any package distributions (npm, PyPI) currently published with the old MIT metadata that should be re-published with the corrected metadata? If a 0.x release went out with MIT in the manifest, the next release should bump version and re-publish so consumers see the correction.