feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

Rebalance several capabilities from the paid tier to the free Community tier:

- Managed Trivy auto-update toggle is admin-only, no longer tier-gated.
- Node labels (assign, view, manage) are available on every tier; cordon and
  FleetSync anchor reset stay paid.
- Fleet topology layout modes (Hub, Grouped, Free) are available on Community.
- Single-scan SBOM export (SPDX and CycloneDX) is admin-only on Community;
  SARIF export stays paid via a dedicated canExportSarif capability split out
  from the former shared SBOM flag.

Backend route guards and frontend affordances are updated together, with tier
and admin-role tests covering the Community-allowed and still-paid paths.

frontend/src/components/NodeManager.tsx

@@ -36,7 +36,7 @@ export interface SenchoNavigateDetail {
 export function NodeManager() {
   const { isPaid } = useLicense();
   const { isAdmin, can } = useAuth();
-  const canEditLabels = isPaid && isAdmin;
+  const canEditLabels = isAdmin;
   // Mirror the backend node:manage guard. This top-level flag checks the global
   // role only (admin or global node-admin); the per-row Test/Edit/Delete buttons
   // below additionally honor scoped per-node grants via can('node:manage', 'node', id).
@@ -368,11 +368,7 @@ export function NodeManager() {
                 </TableCell>
                 <TableCell>{getStatusBadge(node.status)}</TableCell>
                 <TableCell>
-                  {isPaid ? (
-                    <NodeLabelPicker nodeId={node.id} canEdit={canEditLabels} />
-                  ) : (
-                    <span className="text-muted-foreground text-sm">—</span>
-                  )}
+                  <NodeLabelPicker nodeId={node.id} canEdit={canEditLabels} />
                 </TableCell>
                 <TableCell>
                   {(() => {