feat: make all security features available on every tier (#1502)

Scan policies, deploy enforcement, the suppression-aware deploy-block
toggle, SARIF export, and OpenVEX export now work on Community, matching
the rest of the vulnerability-scanning surface that was already free.

Backend: drop the tier gate from the seven security routes and from the
dashboard configuration-status scan-policies row, so the Dashboard and
Fleet config cards stop hiding the Vulnerability scanning row. Reading
policies stays auth-only; mutations and exports stay admin-only.

Frontend: always show the Policies tab and panel, the SARIF and VEX
export actions, and the honor-suppressions toggle for admins.

Docs: move scan policies, SARIF, and OpenVEX to every tier across the
feature and API-reference pages; clarify that Fleet Sync's cross-node
replication remains the paid part.

docs/features/security.mdx

@@ -72,7 +72,7 @@ the secret findings for a scan.
 ## Policies
 
 The Policies tab manages deploy-enforcement scan policies: severity thresholds that block or warn on a
-deploy, scoped by stack pattern. Enforcement is an Admiral capability; see
+deploy, scoped by stack pattern. See
 [scan policies](/features/vulnerability-scanning#scan-policies) for the full configuration.
 
 ## Suppressions
@@ -83,8 +83,8 @@ node; switch to the local node to manage them.
 
 Suppressing a CVE records a **triage decision**: accepted risk, not affected, false positive, fixed,
 ignored, or needs review, with an optional OpenVEX justification. Decided findings stop driving the
-action posture; a "needs review" decision stays counted but keeps the finding actionable. Admiral
-instances can export the fleet's triage decisions as an OpenVEX document for use with other tooling.
+action posture; a "needs review" decision stays counted but keeps the finding actionable. You can
+export the fleet's triage decisions as an OpenVEX document for use with other tooling.
 
 ## History