feat: allow local Docker Hub, GHCR, and custom registry credentials on Community (#1338)

Private registry credentials are no longer paid-only. Community admins can add
and manage Docker Hub, GHCR, and custom/self-hosted registry credentials, stored
locally on the node. AWS ECR (short-lived token refresh, AWS region) stays on the
paid tier.

Backend gates ECR per-type via a single helper applied at create, update (using
the effective type so an existing row cannot be switched to ECR), the per-id
connection test (gated on the stored type), and the stateless test. The admin
role and API-token-scope rejection are unchanged on every route. The frontend
drops the blanket paywall on the Registries section, filters ECR out of the type
selector for Community, and states the ECR requirement inline.

frontend/src/components/settings/__tests__/registry.test.ts

@@ -66,8 +66,9 @@ describe('settings registry', () => {
         expect(byId.get('security')?.label).toBe('Vulnerability Scanning');
     });
 
-    it('preserves the paid gate on Registries', () => {
+    it('opens Registries to Community while keeping it admin-only', () => {
         const registries = SETTINGS_ITEMS.find(i => i.id === 'registries');
-        expect(registries?.tier).toBe('paid');
+        expect(registries?.tier).toBeNull();
+        expect(registries?.adminOnly).toBe(true);
     });
 });

frontend/src/components/settings/registry.ts

@@ -139,7 +139,7 @@ export const SETTINGS_ITEMS: readonly SettingsItemMeta[] = [
         label: 'Registries',
         description: 'Private Docker registries and pull credentials.',
         keywords: ['docker', 'ghcr', 'ecr', 'private', 'pull', 'auth'],
-        tier: 'paid',
+        tier: null,
         scope: 'global',
         adminOnly: true,
         hiddenOnRemote: true,