Server-Side Entitlement & Digital Delivery Boundary

Why paid theme archives are excluded from public assets and how server-side download entitlement is enforced.

Paid theme source archives must never be placed in public/ or unlocked via client-side flags. Because @dinkuskit/commerce 0.3.0 currently defaults simple catalog items to physical fulfillment and does not yet ship a digital license-entitlement module, our /api/downloads/[themeId] endpoint enforces a fail-closed HTTP 403 boundary until a verified server-side order entitlement provider is bound.