fix(licenses): locate license members by extension, not by filename

[traviswu-bigstack]

What type of PR is this?

/kind bug

Which issue(s) this PR fixes?

Fixes #643

What this PR does?

Verify opened <uploaded filename>.dat inside the extracted archive. The .dat/.sig members carry their own stem and need not match the file's name, so any rename — by an operator, a mail client, or a browser saving a duplicate as x (1).license — made a valid, correctly signed license fail with the UI's generic "Invalid files." before the dialog ever appeared. Hit by NYCU on 2026-08-27.

• Locate the pair by extension, matching license_import_extract in sdk_license.sh (cubecos 3ae09672). hex was fixed there, but the API's verify runs first, so the UI failed regardless of the SDK.
• Extract into a per-request temp dir and remove it afterwards. /tmp/license_verify is shared between uploads and was never cleaned — a lab cluster was holding members from three different licenses at once — so an extension lookup in that shared directory could have verified a stale license. That hazard is pinned by a test.
• checkImportLicense now takes the member stem, which is what hex_config license_check appends .dat/.sig to.
• New ErrLicenseMalformedArchive so an archive with no pair reads as malformed rather than as a missing file.

No API surface change, so api/docs.json is untouched.

Test results (optional)

1). make sure the api docs have been updated

No API surface change; api/docs.json unchanged.

2). make sure the api works properly

internal/cubecos/license_verify_test.go — 4 tests. Verified they catch the bug: with the fix reverted, TestParseLicenseDatIgnoresUploadedFilename and TestParseLicenseDatCleansUpMembers fail; all 4 pass with it.

=== RUN   TestParseLicenseDatIgnoresUploadedFilename   --- PASS
=== RUN   TestParseLicenseDatIgnoresStaleMembers       --- PASS
=== RUN   TestParseLicenseDatRejectsArchiveWithoutPair --- PASS
=== RUN   TestParseLicenseDatCleansUpMembers           --- PASS
ok  github.com/bigstack-oss/cube-cos-api/internal/cubecos

go vet ./... clean; ./internal/apis/... and ./internal/cubecos/ green.

Reproduced end-to-end before the fix on a release-build cluster (cube42, 3.1.10) with the real customer license — same bytes, only the filename differing:

uploaded as	result
nycu-adfp3-0 (1).license	"Invalid files." — open …/nycu-adfp3-0 (1).dat: no such file or directory
nycu-adfp3-0.license	verify dialog renders correctly

Not yet re-verified on a live cluster with this fix deployed — worth a hot-swap check before merge.