feat: Plugin architecture for paid tier (medusa-pro as separate package)

[rosschurchill]

Problem

Currently paid features (licensing.py, runtime rules, REST API) are gitignored stubs inside the free repo's directory structure. This causes two issues:

1. Contributor UX — anyone who installs or tests paid features sees a dirty git status with files they can't commit. Creates confusion and friction for contributors.
2. No clean separation — the free package has empty slots for paid code rather than being fully self-contained.

Proposed Solution

Move paid code into a completely separate package (medusa-pro) that installs alongside the free package as a plugin.

Plugin detection pattern

# medusa/__init__.py
try:
    import medusa_pro
    medusa_pro.register()  # injects licensing, runtime rules, API
except ImportError:
    pass  # free tier, fully functional

Install experience

# Free (open source, this repo)
pip install medusa
uv add medusa

# Paid (private repo/index)
pip install medusa-pro --index-url https://pkg.pantheonsecurity.dev
uv add medusa-pro --index https://pkg.pantheonsecurity.dev

Benefits

• Free repo is 100% clean — no gitignored paid stubs
• Contributors never see dirty working tree
• Clear open core boundary
• License key can double as private index auth token
• medusa-pro can be versioned and released independently

Work Required

• Remove licensing.py, api/, runtime rule stubs from free repo gitignore (they move to private repo entirely)
• Add plugin discovery hook in medusa/__init__.py
• Create medusa-pro private repo with plugin registration
• Set up private package index (Cloudflare Worker or GitHub Packages)
• Update CONTRIBUTING.md with architecture explanation