feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185)

* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro)

Introduces three Pro-tier features:

- RBAC: Multi-user system with admin/viewer roles, user management UI,
  automatic migration from single-admin credentials, viewer restrictions
  across the entire UI (read-only editor, hidden action buttons)

- Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic
  rollback on health probe failure, manual rollback button, health probes
  added to stack updates, webhook-triggered deploys use atomic rollback

- Fleet-Wide Backups: Point-in-time snapshots of compose files across all
  nodes (local + remote), stored centrally in SQLite, per-stack restore
  with optional redeploy, graceful handling of offline nodes

* fix(settings): use correct ProGate prop name in UsersSection

* fix(settings): remove unused isPro prop from UsersSection

* fix(auth): fetch user info after login and setup so isAdmin is set correctly

* feat(pricing): revise pricing strategy and enforce variant-based seat limits

Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1).
Add $15/mo billing option for Team Pro. Mark lifetime pricing as a
90-day early-adopter offer. Store Lemon Squeezy variant_name on
activation/validation and enforce seat limits server-side per variant.

* feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration

Server-side checkout URL generation (POST /api/checkout) with admin email
pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint
(POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment
lifecycle events for automatic license activation. Customer billing portal
link stored from webhook events and exposed via GET /api/billing/portal.
In-app checkout buttons in Settings with manual license key fallback.

* fix(licensing): exempt Lemon Squeezy webhook from auth middleware

The catch-all auth middleware on /api/* was blocking the public webhook
endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside
/auth/* and /webhooks/:id/trigger.

* feat(pricing): update pricing to final live rates

Personal Pro: $7.99/month, $69.99/year, $249 lifetime.
Team Pro: $49.99/month, $499.99/year, $1,499 lifetime.
Added personal_monthly checkout variant across backend, frontend, and website.

* refactor(licensing): remove server-side checkout/webhook for self-hosted model

Sencho is self-hosted — each user runs their own instance, so there is
no central server to receive webhooks or hold the store API key. Replaced
in-app checkout buttons with a "View Pricing" redirect to sencho.io and
kept manual license key activation as the primary flow.

- Delete LemonSqueezyService (checkout, webhook, HMAC verification)
- Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy
- Remove raw body parser and auth exemption for webhook route
- Remove all LEMONSQUEEZY_* env vars from .env.example
- Replace checkout buttons in SettingsModal with single "View Pricing" button
- Simplify LicenseContext checkout to open sencho.io pricing page
- Update licensing docs to reflect website-based purchase flow

* chore: normalize em-dashes to hyphens across codebase (linter)

* chore: remove accidentally tracked directories from index

backend/src/__tests__/auth.test.ts

@@ -74,7 +74,7 @@ describe('authMiddleware', () => {
     const res = await request(app)
       .get('/api/stacks')
       .set('Authorization', `Bearer ${token}`);
-    // Will succeed (200) or fail with a docker/fs error (500) — but NOT 401
+    // Will succeed (200) or fail with a docker/fs error (500) - but NOT 401
     expect(res.status).not.toBe(401);
   });
 
@@ -96,7 +96,7 @@ describe('authMiddleware', () => {
 // ─── Protected endpoint: console-token ───────────────────────────────────────
 
 describe('POST /api/system/console-token', () => {
-  it('returns 401 without authentication (was a security bug — C1 fix)', async () => {
+  it('returns 401 without authentication (was a security bug - C1 fix)', async () => {
     const res = await request(app).post('/api/system/console-token');
     expect(res.status).toBe(401);
   });

backend/src/__tests__/health.test.ts

@@ -33,7 +33,7 @@ describe('GET /api/health', () => {
   });
 
   it('does not require an auth token', async () => {
-    // No cookie, no Authorization header — must still return 200
+    // No cookie, no Authorization header - must still return 200
     const res = await request(app).get('/api/health');
     expect(res.status).not.toBe(401);
     expect(res.status).not.toBe(403);

backend/src/__tests__/helpers/setupTestDb.ts

@@ -1,5 +1,5 @@
 /**
- * Test DB helper — creates a temporary SQLite database, seeds it with a known
+ * Test DB helper - creates a temporary SQLite database, seeds it with a known
  * admin credential, and sets process.env so DatabaseService uses it.
  *
  * Call this at the top of every test file *before* importing the app,

backend/src/__tests__/nodes.test.ts

@@ -1,5 +1,5 @@
 /**
- * Tests for node management API — focusing on api_url validation (SSRF fix C2).
+ * Tests for node management API - focusing on api_url validation (SSRF fix C2).
  */
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import request from 'supertest';
@@ -21,7 +21,7 @@ afterAll(() => {
   cleanupTestDb(tmpDir);
 });
 
-describe('POST /api/nodes — api_url SSRF validation (C2 fix)', () => {
+describe('POST /api/nodes - api_url SSRF validation (C2 fix)', () => {
   it('rejects localhost api_url', async () => {
     const res = await request(app)
       .post('/api/nodes')
@@ -66,7 +66,7 @@ describe('POST /api/nodes — api_url SSRF validation (C2 fix)', () => {
         api_url: 'http://192.168.1.50:3000',
         api_token: 'sometoken',
       });
-    // Should succeed (201 or 200) — not a validation error
+    // Should succeed (201 or 200) - not a validation error
     expect(res.status).not.toBe(400);
   });