feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185)

* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro)

Introduces three Pro-tier features:

- RBAC: Multi-user system with admin/viewer roles, user management UI,
  automatic migration from single-admin credentials, viewer restrictions
  across the entire UI (read-only editor, hidden action buttons)

- Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic
  rollback on health probe failure, manual rollback button, health probes
  added to stack updates, webhook-triggered deploys use atomic rollback

- Fleet-Wide Backups: Point-in-time snapshots of compose files across all
  nodes (local + remote), stored centrally in SQLite, per-stack restore
  with optional redeploy, graceful handling of offline nodes

* fix(settings): use correct ProGate prop name in UsersSection

* fix(settings): remove unused isPro prop from UsersSection

* fix(auth): fetch user info after login and setup so isAdmin is set correctly

* feat(pricing): revise pricing strategy and enforce variant-based seat limits

Raise Personal Pro from $49/yr to $69/yr with 3 viewer seats (up from 1).
Add $15/mo billing option for Team Pro. Mark lifetime pricing as a
90-day early-adopter offer. Store Lemon Squeezy variant_name on
activation/validation and enforce seat limits server-side per variant.

* feat(licensing): add Lemon Squeezy checkout, webhook, and billing portal integration

Server-side checkout URL generation (POST /api/checkout) with admin email
pre-fill and instance_id custom data. HMAC-SHA256 verified webhook endpoint
(POST /api/webhooks/lemonsqueezy) handling order, subscription, and payment
lifecycle events for automatic license activation. Customer billing portal
link stored from webhook events and exposed via GET /api/billing/portal.
In-app checkout buttons in Settings with manual license key fallback.

* fix(licensing): exempt Lemon Squeezy webhook from auth middleware

The catch-all auth middleware on /api/* was blocking the public webhook
endpoint. Added /webhooks/lemonsqueezy to the exemption list alongside
/auth/* and /webhooks/:id/trigger.

* feat(pricing): update pricing to final live rates

Personal Pro: $7.99/month, $69.99/year, $249 lifetime.
Team Pro: $49.99/month, $499.99/year, $1,499 lifetime.
Added personal_monthly checkout variant across backend, frontend, and website.

* refactor(licensing): remove server-side checkout/webhook for self-hosted model

Sencho is self-hosted — each user runs their own instance, so there is
no central server to receive webhooks or hold the store API key. Replaced
in-app checkout buttons with a "View Pricing" redirect to sencho.io and
kept manual license key activation as the primary flow.

- Delete LemonSqueezyService (checkout, webhook, HMAC verification)
- Remove POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/lemonsqueezy
- Remove raw body parser and auth exemption for webhook route
- Remove all LEMONSQUEEZY_* env vars from .env.example
- Replace checkout buttons in SettingsModal with single "View Pricing" button
- Simplify LicenseContext checkout to open sencho.io pricing page
- Update licensing docs to reflect website-based purchase flow

* chore: normalize em-dashes to hyphens across codebase (linter)

* chore: remove accidentally tracked directories from index

e2e/auth.spec.ts

@@ -49,7 +49,7 @@ test.describe('Authentication', () => {
 
   test('logout returns to the login screen', async ({ page }) => {
     await loginAs(page);
-    // Log Out is inside the User Profile Dropdown — open it first
+    // Log Out is inside the User Profile Dropdown - open it first
     await page.getByRole('button', { name: /profile/i }).click();
     await page.getByRole('button', { name: /log out/i }).click();
     await page.waitForTimeout(1_000);

e2e/helpers.ts

@@ -12,7 +12,7 @@ import { Page, expect } from '@playwright/test';
 export const TEST_USERNAME = process.env.E2E_USERNAME ?? 'admin';
 export const TEST_PASSWORD = process.env.E2E_PASSWORD ?? 'password123';
 
-/** Selector for the dashboard — only present in EditorLayout, not on login/setup pages */
+/** Selector for the dashboard - only present in EditorLayout, not on login/setup pages */
 const DASHBOARD_INDICATOR = 'img[alt="Sencho Logo"]';
 
 /** Returns true if the current page is the first-run setup screen */
@@ -67,7 +67,7 @@ export async function loginAs(page: Page, username = TEST_USERNAME, password = T
   }
 
   throw new Error(
-    'loginAs: could not determine page state — expected setup, login, or dashboard. ' +
+    'loginAs: could not determine page state - expected setup, login, or dashboard. ' +
     'Check that E2E_USERNAME and E2E_PASSWORD are set correctly.',
   );
 }

e2e/nodes.spec.ts

@@ -8,7 +8,7 @@ import { loginAs } from './helpers';
 test.describe('Node management', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page);
-    // Settings is inside the User Profile Dropdown — open it first
+    // Settings is inside the User Profile Dropdown - open it first
     await page.getByRole('button', { name: /profile/i }).click();
     await page.getByRole('button', { name: /settings/i }).click();
     await page.getByRole('button', { name: /^nodes$/i }).click();
@@ -28,7 +28,7 @@ test.describe('Node management', () => {
     // Wait for the dialog form to be ready
     await expect(page.locator('#node-name')).toBeVisible({ timeout: 5_000 });
     // The API URL field only renders when type === 'remote'.
-    // #node-type is a Radix UI combobox — click to open, then pick the option.
+    // #node-type is a Radix UI combobox - click to open, then pick the option.
     await page.locator('#node-type').click();
     await page.getByRole('option', { name: /remote/i }).click();
     // Confirm the API URL field is now visible before proceeding

e2e/screenshots.spec.ts

@@ -16,7 +16,7 @@ const DOCS_IMAGES = path.resolve(__dirname, '../docs/images');
 
 test.use({
   viewport: { width: 1280, height: 800 },
-  // Always capture — this spec exists solely to produce screenshots
+  // Always capture - this spec exists solely to produce screenshots
   screenshot: 'on',
 });
 

e2e/stacks.spec.ts

@@ -1,5 +1,5 @@
 /**
- * Stack management E2E tests — happy path CRUD.
+ * Stack management E2E tests - happy path CRUD.
  */
 import { test, expect } from '@playwright/test';
 import { loginAs } from './helpers';
@@ -17,7 +17,7 @@ async function waitForStacksLoaded(page: import('@playwright/test').Page) {
 /** Delete the test stack via the browser's authenticated fetch (so cookies are included). */
 async function deleteTestStackViaApi(page: import('@playwright/test').Page) {
   await page.evaluate(async (name) => {
-    await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
+    await fetch(`/api/stacks/${name}`, { method: 'DELETE', credentials: 'include' }).catch(() => { });
   }, TEST_STACK);
 }
 
@@ -47,9 +47,9 @@ test.describe('Stack management', () => {
     await Promise.race([
       page.getByRole('dialog').waitFor({ state: 'hidden', timeout: 8_000 }),
       page.getByText(/already exists/i).waitFor({ state: 'visible', timeout: 8_000 }),
-    ]).catch(() => {});
+    ]).catch(() => { });
 
-    // The stack should now exist — refresh and verify via the sidebar
+    // The stack should now exist - refresh and verify via the sidebar
     await page.reload();
     await loginAs(page);
     await waitForStacksLoaded(page);