chore(phase-3): mark on-prem license validation complete

Phase 3 work was done in TapTrack on-prem repo.
Hub side (POST /api/licenses/validate) was already done in Phase 1.

PAUL updates:
- ROADMAP: Phase 3 marked complete
- STATE: Phase 3 done, Phase 4 next
- phases/03-onprem-license/README.md: updated with what was built

.paul/phases/03-onprem-license/README.md

@@ -1,9 +1,22 @@
 # Phase 03: On-Prem License Validation
 
-**Status:** Not started
+**Status:** ✅ Complete — 2026-03-15
 
 ## Goal
 TapTrack validates license key against Hub on startup; returns feature flags and school config.
 
-## Plans
-- [ ] TBD — run /paul:plan when Phase 2 is complete
+## Completed
+
+### 3-01: On-prem license validation + frontend warning banner
+- config.py: hub_url + hub_license_key settings (blank = standalone mode)
+- docker-compose.yml: HUB_URL + HUB_LICENSE_KEY env vars on all services
+- backend/app/tasks/license.py: validate_license_now(), get_license_status(),
+  is_feature_enabled(); Celery task license.validate registered
+- backend/app/worker.py: license task in includes + 6h beat schedule
+- backend/app/main.py: asynccontextmanager lifespan + startup validation + hub router
+- backend/app/routers/hub.py: GET /api/hub/license-status, POST /api/hub/license-refresh
+- frontend api.ts: HubLicenseStatus interface, getHubLicenseStatus(), refreshHubLicense()
+- AppLayout.vue: animated banner (red=expired/revoked/invalid, amber=expiring ≤30 days);
+  polls every 30min; dismiss + admin refresh button; no banner in standalone mode
+
+Hub side: POST /api/licenses/validate was complete from Phase 1 — no new work needed.