feat: make all security features available on every tier (#1502)

Scan policies, deploy enforcement, the suppression-aware deploy-block
toggle, SARIF export, and OpenVEX export now work on Community, matching
the rest of the vulnerability-scanning surface that was already free.

Backend: drop the tier gate from the seven security routes and from the
dashboard configuration-status scan-policies row, so the Dashboard and
Fleet config cards stop hiding the Vulnerability scanning row. Reading
policies stays auth-only; mutations and exports stay admin-only.

Frontend: always show the Policies tab and panel, the SARIF and VEX
export actions, and the honor-suppressions toggle for admins.

Docs: move scan policies, SARIF, and OpenVEX to every tier across the
feature and API-reference pages; clarify that Fleet Sync's cross-node
replication remains the paid part.

backend/src/routes/dashboard.ts

@@ -52,7 +52,6 @@ export function buildLocalConfigurationStatus(
   tier: LicenseTier,
 ): ConfigurationStatus {
   const db = DatabaseService.getInstance();
-  const isPaid = tier === 'paid';
 
   const agents = db.getAgents(nodeId);
   const agentByType = (type: 'discord' | 'slack' | 'webhook'): AgentStatus => {
@@ -129,11 +128,11 @@ export function buildLocalConfigurationStatus(
       mfaEnabled: mfaRow ? mfaRow.enabled === 1 : null,
       ssoEnabled: !!enabledSso,
       ssoProvider: enabledSso?.provider ?? null,
-      // Scan policies (deploy enforcement) require a paid license.
+      // Scan policies are available on every tier.
       scanPolicies: {
         total: scanPolicies.length,
         enabled: scanPolicies.filter(p => p.enabled === 1).length,
-        locked: !isPaid,
+        locked: false,
       },
     },
     thresholds: {