feat: drop stack labels and network topology to Community tier (#995)

* feat(labels): drop tier gate to Community for organization endpoints

Stack Labels CRUD and per-stack assignment are now Community-tier features:
list, create, update, delete labels, and assign labels to a single stack.

The two automation surfaces stay Skipper+: per-label bulk deploy / stop /
restart (POST /api/labels/:id/action) and the Fleet Actions tab's
bulk-assign card (POST /api/fleet-actions/labels/bulk-assign). Tier story
is now organize free, automate paid.

Add a route-level test that proves the CRUD endpoints succeed on a Community
license while the bulk-action endpoint still returns 403. Update overview,
licensing, and stack-labels docs to reflect the new tier placement and to
note that bulk actions on a label still require Skipper or Admiral.

* feat(topology): drop tier gate to Community for network topology view

The Resources tab's Networks > Topology view is now available on every tier.
Drops requirePaid from GET /api/system/networks/topology, removes the
isPaid wrapper around the List | Topology toggle in ResourcesView, and
removes the PaidGate around the topology graph.

CapabilityGate stays in place so a node running on a build without the
network-topology capability still renders its lock card instead of the
graph. Add a route-level test that proves the endpoint returns 200 on a
Community license. Update licensing and resources docs to reflect the new
tier placement.

* fix(labels): expose Settings > Labels tab on Community tier

The settings registry entry for the Labels tab still carried tier:
'skipper', which kept the tab hidden in the Settings sidebar even though
the underlying CRUD endpoints now serve Community. Drop the tier flag so
Community users can discover and reach the section that backs the
already-Community-tier label endpoints.

docs/features/licensing.mdx

@@ -24,6 +24,8 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
 **Community** includes:
 - Unlimited nodes, compose editor, global logs, app store, alerts, and more
 - Fleet View with search, sort, filters, node-card expand, and topology
+- Stack labels
+- Network topology graph
 - Manual fleet snapshots (create, browse, restore, delete)
 - Per-node Sencho updates and the Check Updates view
 - Vulnerability scanning: install/update/uninstall Trivy, on-demand scans (vulnerabilities, secrets, misconfigurations), scan comparison, and CVE suppressions
@@ -31,7 +33,8 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
 - Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC identity provider)
 
 **Skipper** includes everything in Community, plus:
-- Webhooks and stack labels
+- Webhooks
+- Bulk actions on a label (deploy, stop, or restart every stack tagged with it)
 - Atomic deployments
 - Bulk **Update All** across the fleet, scheduled scans, scheduled updates, and scheduled fleet snapshots
 - Scan policies with `block_on_deploy` enforcement, SBOM (SPDX, CycloneDX), and SARIF export