feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185)

* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro)

Introduces three Pro-tier features:

- RBAC: Multi-user system with admin/viewer roles, user management UI,
  automatic migration from single-admin credentials, viewer restrictions
  across the entire UI (read-only editor, hidden action buttons)

- Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic
  rollback on health probe failure, manual rollback button, health probes
  added to stack updates, webhook-triggered deploys use atomic rollback

- Fleet-Wide Backups: Point-in-time snapshots of compose files across all
  nodes (local + remote), stored centrally in SQLite, per-stack restore
  with optional redeploy, graceful handling of offline nodes

* fix(settings): use correct ProGate prop name in UsersSection

* fix(settings): remove unused isPro prop from UsersSection

* fix(auth): fetch user info after login and setup so isAdmin is set correctly

* feat(pricing): revise pricing strategy and enforce variant-based seat limits

Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1).
Add $15/mo billing option for Team Pro. Mark lifetime pricing as a
90-day early-adopter offer. Store Lemon Squeezy variant_name on
activation/validation and enforce seat limits server-side per variant.

* feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration

Server-side checkout URL generation (POST /api/checkout) with admin email
pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint
(POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment
lifecycle events for automatic license activation. Customer billing portal
link stored from webhook events and exposed via GET /api/billing/portal.
In-app checkout buttons in Settings with manual license key fallback.

* fix(licensing): exempt Lemon Squeezy webhook from auth middleware

The catch-all auth middleware on /api/* was blocking the public webhook
endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside
/auth/* and /webhooks/:id/trigger.

* feat(pricing): update pricing to final live rates

Personal Pro: $7.99/month, $69.99/year, $249 lifetime.
Team Pro: $49.99/month, $499.99/year, $1,499 lifetime.
Added personal_monthly checkout variant across backend, frontend, and website.

* refactor(licensing): remove server-side checkout/webhook for self-hosted model

Sencho is self-hosted — each user runs their own instance, so there is
no central server to receive webhooks or hold the store API key. Replaced
in-app checkout buttons with a "View Pricing" redirect to sencho.io and
kept manual license key activation as the primary flow.

- Delete LemonSqueezyService (checkout, webhook, HMAC verification)
- Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy
- Remove raw body parser and auth exemption for webhook route
- Remove all LEMONSQUEEZY_* env vars from .env.example
- Replace checkout buttons in SettingsModal with single "View Pricing" button
- Simplify LicenseContext checkout to open sencho.io pricing page
- Update licensing docs to reflect website-based purchase flow

* chore: normalize em-dashes to hyphens across codebase (linter)

* chore: remove accidentally tracked directories from index

docs/operations/troubleshooting.mdx

@@ -15,13 +15,13 @@ docker compose -f /path/to/your/stack/compose.yaml logs
 
 The most common causes:
 
-- **Missing environment variable** — a required variable in your `.env` file is empty or has the wrong name.
-- **Port already in use** — another container or host process is bound to the same port. Change the host port in the compose file.
-- **Volume path does not exist** — a bind-mount path on the host doesn't exist yet. Create the directory manually.
+- **Missing environment variable** - a required variable in your `.env` file is empty or has the wrong name.
+- **Port already in use** - another container or host process is bound to the same port. Change the host port in the compose file.
+- **Volume path does not exist** - a bind-mount path on the host doesn't exist yet. Create the directory manually.
 
 ---
 
-## The 1:1 path rule — volumes resolve to wrong paths
+## The 1:1 path rule - volumes resolve to wrong paths
 
 **Symptom:** Stacks deploy but relative volume paths (e.g. `./config:/config`) point to the wrong location inside the container, or `docker compose` exits with a path error.
 
@@ -37,7 +37,7 @@ environment:
   - COMPOSE_DIR=/opt/docker
 ```
 
-See [Configuration — the 1:1 path rule](/getting-started/configuration#compose-directory-the-11-path-rule) for a full explanation.
+See [Configuration - the 1:1 path rule](/getting-started/configuration#compose-directory-the-11-path-rule) for a full explanation.
 
 ---
 
@@ -61,7 +61,7 @@ ls -la /var/run/docker.sock
 # Expected: srw-rw---- 1 root docker ...
 ```
 
-If the group is not `docker`, the auto-detection still works — Sencho reads the GID from the socket file at startup.
+If the group is not `docker`, the auto-detection still works - Sencho reads the GID from the socket file at startup.
 
 ---
 
@@ -95,7 +95,7 @@ proxy_set_header Connection "upgrade";
 proxy_read_timeout 3600s;
 ```
 
-Traefik handles WebSocket upgrades automatically for HTTP/1.1 backends — no extra config needed.
+Traefik handles WebSocket upgrades automatically for HTTP/1.1 backends - no extra config needed.
 
 ---
 
@@ -106,7 +106,7 @@ Traefik handles WebSocket upgrades automatically for HTTP/1.1 backends — no ex
 **Checks in order:**
 
 1. **Is the remote Sencho instance running?** SSH to that machine and verify.
-2. **Is the API URL correct?** It must include the protocol and port (e.g. `http://192.168.1.20:3001`). Open it in a browser — you should see a JSON response from `/api/health`.
+2. **Is the API URL correct?** It must include the protocol and port (e.g. `http://192.168.1.20:3001`). Open it in a browser - you should see a JSON response from `/api/health`.
 3. **Is the token correct?** Tokens are long JWT strings. Even one missing character will cause auth to fail. Regenerate the token on the remote instance and update the node config.
 4. **Is there a firewall blocking the port?** The primary Sencho host must be able to reach the remote host's Sencho port.
 
@@ -131,7 +131,7 @@ sqlite3 /path/to/data/sencho.db
 DELETE FROM global_settings WHERE key IN ('auth_username', 'auth_password_hash', 'auth_jwt_secret');
 ```
 
-4. Restart the container — the setup screen will appear on next visit.
+4. Restart the container - the setup screen will appear on next visit.
 
 <Warning>
   This resets authentication entirely. All active sessions become invalid. Your stacks, nodes, and alert rules are not affected.