feat: add is_enterprise_only attribute to apps

[edward-ly]

Resolves #1785. In lieu of validating subscription keys, for now, a simple include_enterprise query parameter is added to the /api/v1/apps.json endpoint which controls whether or not enterprise-only apps are included in the list.

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

[julien-nc]

I'm not familiar with the appstore code so I had a look and: Lgtm.
Then I asked Qwen:

• urls.py:45 — appapi_apps.json uses apps_all_etag which now reads include_enterprise from the request. But AppApiAppsView doesn't filter by is_enterprise_only, so sending ?include_enterprise=true to that endpoint would compute an etag over a different dataset than what's actually returned. Either:
  • Give AppApiAppsView its own etag function that ignores the param, or
  • Also filter enterprise apps in AppApiAppsView if that makes sense for the app API.
• caching.py:42-57 — apps_etag and apps_last_modified still use App.objects.all(). The AppView (per-version) doesn't filter enterprise-only apps either. If the intent is to hide enterprise apps from the public app list, shouldn't the per-version endpoint also exclude them? This is the endpoint Nextcloud server actually calls to get compatible apps.
• The AppSerializer doesn't include is_enterprise_only, so API consumers can't tell which apps are enterprise-only. This might be intentional, but seems like an oversight — at minimum the Nextcloud server would need to know.
• views.py:198 — When an existing app owner re-registers (e.g. to update their certificate), is_enterprise_only gets overwritten from the request body. This means the owner can silently toggle the flag at any time via re-registration, which contradicts the issue's intent that only admins should be able to change it post-registration. Consider only setting it on creation
• The query param parsing is duplicated between AppsView._include_enterprise (views.py) and _include_enterprise (caching.py) with slightly different implementations. Extract to a shared utility.

Wdyt?

[edward-ly]

All bullet points should now be addressed, thanks!