feat(fleet): open Fleet Actions tab to Community (admin-only) (#1153)

* feat(fleet): open Fleet Actions tab to Community (admin-only)

Removes the requirePaid guard from the five Fleet Actions endpoints
(fleet-stop, fleet-prune, match-preview, prune/estimate, bulk-assign)
and drops the matching isPaid parent gate on FleetActionsTab so Community
admins can run fleet-wide bulk operations. requireAdmin stays on every
endpoint; operator and viewer roles still 403 on apply.

Tests flipped from "403 PAID_REQUIRED on community" to positive
"reachable on community + admin" assertions. Docs (fleet-actions,
fleet-view, licensing, overview, stack-labels) rewritten to state the
admin-role requirement once and drop the prior Skipper framing.

* fix(fleet): apply audit findings from PR #1153 review

- stack-labels.mdx: fix the page intro that still framed fleet label
  actions as "Operators on a Skipper or Admiral license". The cards are
  now Community + admin, so the intro reads "Admins also get a pair of
  fleet-wide actions".
- Collapse redundant role-rule statements on the two affected pages.
  fleet-actions.mdx now states the admin gate once in the lead-in Note
  and again only in the troubleshooting accordion (the Prerequisites
  row was duplicative). stack-labels.mdx trims the "Limits and rules"
  bullet to the value-add half (label authoring is open to every role)
  and drops the Fleet Actions repetition.
- Strip now-no-op mockTier('paid') calls from non-tier tests across the
  three fleet test files, plus the test-wide default in the
  fleet-action-card-endpoints beforeEach. Those mocks were misleading
  after the routes stopped consulting tier; if a future change re-adds
  requirePaid the tests will fail loudly instead of silently passing.

backend/src/__tests__/fleet-prune.test.ts

@@ -66,18 +66,19 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
     expect(res.status).toBe(401);
   });
 
-  it('returns 403 PAID_REQUIRED on community tier', async () => {
+  it('is reachable on community tier for admins (no PAID_REQUIRED)', async () => {
     mockTier('community');
+    mockLocalPrune({ managedBytes: { images: 128 } });
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
       .set('Authorization', authHeader)
       .send({ targets: ['images'], scope: 'managed' });
-    expect(res.status).toBe(403);
-    expect(res.body.code).toBe('PAID_REQUIRED');
+    expect(res.status).toBe(200);
+    expect(res.body.code).not.toBe('PAID_REQUIRED');
+    expect(Array.isArray(res.body.results)).toBe(true);
   });
 
   it('returns 400 when body is missing', async () => {
-    mockTier('paid');
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
       .set('Authorization', authHeader)
@@ -86,7 +87,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('returns 400 when targets is empty', async () => {
-    mockTier('paid');
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
       .set('Authorization', authHeader)
@@ -96,7 +96,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('returns 400 when a target is unrecognized', async () => {
-    mockTier('paid');
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
       .set('Authorization', authHeader)
@@ -106,7 +105,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('runs pruneManagedOnly per target on the local node and returns aggregated bytes', async () => {
-    mockTier('paid');
     const fake = mockLocalPrune({ managedBytes: { images: 1500, volumes: 320 } });
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
@@ -125,7 +123,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('runs pruneSystem when scope is "all" and dedupes targets', async () => {
-    mockTier('paid');
     const fake = mockLocalPrune({ allBytes: { networks: 0, images: 2048 } });
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
@@ -139,7 +136,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('records per-target failure when DockerController throws but continues remaining targets', async () => {
-    mockTier('paid');
     mockLocalPrune({ managedBytes: { images: 100 }, throwOn: 'volumes' });
     const res = await request(app)
       .post('/api/fleet/labels/fleet-prune')
@@ -155,7 +151,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('reports lock contention when bulk-prune lock is already held', async () => {
-    mockTier('paid');
     mockLocalPrune();
     const db = DatabaseService.getInstance();
     const localId = db.getNodes().find(n => n.type === 'local')!.id;
@@ -171,7 +166,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('marks a remote node unreachable when fetch throws and short-circuits later targets', async () => {
-    mockTier('paid');
     mockLocalPrune();
     const db = DatabaseService.getInstance();
     const remoteId = db.addNode({
@@ -202,7 +196,6 @@ describe('POST /api/fleet/labels/fleet-prune', () => {
   });
 
   it('parses remote node responses into per-target reclaimed bytes', async () => {
-    mockTier('paid');
     mockLocalPrune();
     const db = DatabaseService.getInstance();
     const remoteId = db.addNode({