Nullable FK from License to PurchaseOrder for supply-side traceability (which PO a license came in through), mirroring AssetItem.purchaseOrderId's just-merged pattern exactly. Separate commit from the earlier License.vendorId retrofit per the project's 1-commit-per-business-change convention.