Third-party notices

Runtime dependencies are bundled locally: React/React DOM (MIT), @xmldom/xmldom (MIT), DuckDB-WASM and Apache Arrow JavaScript (MIT), add·ideas Toolbox Contract/Shell 0.3.0 (Apache-2.0), and Toolbox Helpers 0.2.0 (GPL-3.0-or-later). No DuckDB asset is fetched at runtime. Exact texts are generated into LICENSES/npm-runtime-licenses.txt.