Concern refactor, B8 models migration, full REST API and namespace rename

[sultann]

Summary

Stacked on #521 (the 2.4.0 framework migration). This branch carries the structural work for the release after 2.4.0 — version number to be decided at cut time.

Changes

• Concern-based reorganization: Keys/, Activations/, Orders/, Stocks/ concern folders (component + Admin + ListTable); Cart, Shop, Products singles; Cron/Cache/Actions/Frontend dissolved into their owning concerns. Admin/ keeps chrome only: Admin, Settings, slim Menus registrar, Tools, Reports. The tools tabs the pro replaces stay registered under their pre-rename static callable identity.
• Templates: all admin views moved to templates/admin/ and rendered through the B8 template service; Admin::view() removed.
• Models on byteever/models: Key/Activation ported with full legacy compatibility — identical public API and error codes, every legacy lifecycle hook still firing under its old name, encryption moved into the model's DB boundary with the legacy encryption filters still applying, and an arg-translation layer covering the entire old query dialect (list tables, wcsn_* functions, pro's where_query export). The models use the native B8 API throughout — no legacy statics, no query-arg translation, no legacy filter re-fires, and no vendor patching; every call site in the free and pro plugins was converted to the native dialect.
• Full REST API following the wp-ever-accounting Routes/Controllers pattern: wcsn/v1/keys and wcsn/v1/activations resources (CRUD, options, batch) on the B8 router; the legacy wcsn/validate|activate|deactivate software endpoints preserved byte-identical in a Software controller.
• Namespace rename to PluginEver\SerialNumbers with a prepended alias autoloader (generic namespace fallback + explicit map for relocated classes) and contract tests asserting the legacy class names, the pro's tab-removal callback identities, and all REST routes.

Verification

• Free suite: 27 tests / 117 assertions green (baseline 24 + 3 new contract tests covering aliases, legacy callback identities, REST routes).
• Pro suite (19 tests) green against this branch.
• phpcs clean, assets build, pot regenerated. Hook parity diffed against master — every delta accounted for (notices service internalization, encryption filters moved from component listeners into the model, restored plugin row links).

[sultann]

Release blocker: this branch removes the legacy model compatibility layer, so Key::query() no longer exists — but both shipped pro versions call it (1.4.6 at includes/Admin/Actions.php:453, 1.5.0 at includes/Admin/Tools.php:414). Shipping this fatals those admin screens on any site with pro active.

Required before this ships:

1. Add an explicit deprecated static query() on includes/Models/Model.php delegating to results() (explicit method, not __callStatic — magic shims on B8 models caused the static get() bug).
2. Extend ContractTest from class-level to method-level: assert is_callable for every method shipped pro versions invoke (Key::query, Settings::instance/save_defaults, get_version, the Menus static tab callbacks).
3. Gate: do not release until a pro version that no longer relies on the aliased old namespace is shipped and adopted, per the phased policy in .claude/commands/migrate-b8.md.