feat: make all security features available on every tier (#1502)

Scan policies, deploy enforcement, the suppression-aware deploy-block
toggle, SARIF export, and OpenVEX export now work on Community, matching
the rest of the vulnerability-scanning surface that was already free.

Backend: drop the tier gate from the seven security routes and from the
dashboard configuration-status scan-policies row, so the Dashboard and
Fleet config cards stop hiding the Vulnerability scanning row. Reading
policies stays auth-only; mutations and exports stay admin-only.

Frontend: always show the Policies tab and panel, the SARIF and VEX
export actions, and the honor-suppressions toggle for admins.

Docs: move scan policies, SARIF, and OpenVEX to every tier across the
feature and API-reference pages; clarify that Fleet Sync's cross-node
replication remains the paid part.

frontend/src/components/stack/PreDeployScanDialog.tsx

@@ -21,7 +21,7 @@ interface PreDeployScanDialogProps {
  * Advisory pre-deploy review. Shows the latest cached scan for each image in a
  * manual deploy so the operator can review the security posture before
  * proceeding. Unlike PolicyBlockDialog this never blocks: anyone can deploy or
- * cancel, and there is no override gate (blocking is the paid deploy-block
+ * cancel, and there is no override gate (blocking is the deploy-block
  * policy). Opened opt-in via the pre-deploy scan advisory setting.
  */
 export function PreDeployScanDialog({ open, stackName, images, onCancel, onDeploy }: PreDeployScanDialogProps) {