feat(notifications): move Notification Routing to Skipper tier (#1145)

* feat(notifications): move Notification Routing to Skipper tier

Notification routing is automation (route alerts to channels by rules),
not enterprise compliance. Aligning the gate with Skipper makes the tier
boundary read consistently with the rest of the automation surface
(webhooks, auto-update, auto-heal, scheduled tasks).

Backend: requireAdmiral -> requirePaid on the five /api/notification-routes
endpoints. Dashboard configuration-status now exposes the routing-rules
row to any paid tier.

Frontend: settings registry tier flipped to skipper; the Admiral wrapper
around NotificationRoutingSection is removed (the inner CapabilityGate
stays, preserving forward-compat with older remote nodes).

Tests: added a tier-enforcement describe block covering Skipper (200) and
Community (403 PAID_REQUIRED on all five endpoints).

Docs: refreshed alerts-notifications, licensing, overview, dashboard,
troubleshooting, and reference/settings; cleaned one fence-spec line per
Directive 31.

* fix(notifications): address audit findings on tier-move PR

Docs: rewrite three lines that survived the initial sweep. The dashboard
"you do not see a locked placeholder" clause and the settings.mdx
"hidden on Community and Skipper" phrase were Directive 31 fence-spec.
The alerts-notifications troubleshooting note still said "an Admiral
routing rule" and contradicted the tier move.

Tests: the Community-negative cases on POST/PUT/DELETE/POST :id/test
could not distinguish requirePaid from a stray requireAdmiral, because
Community fails on the tier check before variant is read. Adding
Skipper-positive coverage per endpoint locks the gate identity in.
Replace the leaky mockReturnValueOnce with a per-test mockReturnValue
plus an afterEach restore so spies cannot bleed across tests.

backend/src/__tests__/notification-routes-api.test.ts

@@ -2,7 +2,7 @@
  * Integration tests for Notification Routes CRUD endpoints,
  * auth enforcement, input validation, and test dispatch.
  */
-import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
 import request from 'supertest';
 import bcrypt from 'bcrypt';
 import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
@@ -10,6 +10,7 @@ import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTes
 let tmpDir: string;
 let app: import('express').Express;
 let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+let licenseService: import('../services/LicenseService').LicenseService;
 let authCookie: string;
 let viewerCookie: string;
 
@@ -19,9 +20,10 @@ beforeAll(async () => {
 
   // Mock LicenseService so Admiral-gated routes are accessible
   const { LicenseService } = await import('../services/LicenseService');
-  vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
-  vi.spyOn(LicenseService.getInstance(), 'getVariant').mockReturnValue('admiral');
-  vi.spyOn(LicenseService.getInstance(), 'getSeatLimits').mockReturnValue({ maxAdmins: null, maxViewers: null });
+  licenseService = LicenseService.getInstance();
+  vi.spyOn(licenseService, 'getTier').mockReturnValue('paid');
+  vi.spyOn(licenseService, 'getVariant').mockReturnValue('admiral');
+  vi.spyOn(licenseService, 'getSeatLimits').mockReturnValue({ maxAdmins: null, maxViewers: null });
 
   ({ app } = await import('../index'));
   authCookie = await loginAsTestAdmin(app);
@@ -88,6 +90,98 @@ describe('Notification Routes - auth enforcement', () => {
   });
 });
 
+// --- Tier enforcement (Skipper or Admiral) ---
+//
+// Skipper-positive tests exist per endpoint so that a future regression
+// reverting any single handler to `requireAdmiral` is caught: with the
+// default mock returning `admiral`, a stray `requireAdmiral` would still
+// pass the Community-negative tests below (Community fails on tier
+// before variant is checked), so only Skipper-positive coverage proves
+// the gate is `requirePaid`. `afterEach` restores the suite defaults so
+// per-test mock overrides cannot leak across tests.
+
+describe('Notification Routes - tier enforcement', () => {
+  afterEach(() => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('paid');
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('admiral');
+  });
+
+  it('GET /api/notification-routes returns 200 when the variant is Skipper', async () => {
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('skipper');
+    const res = await request(app).get('/api/notification-routes').set('Cookie', authCookie);
+    expect(res.status).toBe(200);
+    expect(Array.isArray(res.body)).toBe(true);
+  });
+
+  it('POST /api/notification-routes returns 201 when the variant is Skipper', async () => {
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('skipper');
+    const res = await request(app)
+      .post('/api/notification-routes')
+      .set('Cookie', authCookie)
+      .send({ name: 'skipper-positive', stack_patterns: ['app'], channel_type: 'discord', channel_url: 'https://discord.com/api/webhooks/123/abc' });
+    expect(res.status).toBe(201);
+    if (typeof res.body?.id === 'number') {
+      DatabaseService.getInstance().deleteNotificationRoute(res.body.id);
+    }
+  });
+
+  it('PUT /api/notification-routes/:id returns 404 (gate passed) when the variant is Skipper', async () => {
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('skipper');
+    const res = await request(app).put('/api/notification-routes/99999').set('Cookie', authCookie).send({ name: 'x' });
+    expect(res.status).toBe(404);
+  });
+
+  it('DELETE /api/notification-routes/:id returns 404 (gate passed) when the variant is Skipper', async () => {
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('skipper');
+    const res = await request(app).delete('/api/notification-routes/99999').set('Cookie', authCookie);
+    expect(res.status).toBe(404);
+  });
+
+  it('POST /api/notification-routes/:id/test returns 404 (gate passed) when the variant is Skipper', async () => {
+    vi.spyOn(licenseService, 'getVariant').mockReturnValue('skipper');
+    const res = await request(app).post('/api/notification-routes/99999/test').set('Cookie', authCookie);
+    expect(res.status).toBe(404);
+  });
+
+  it('GET /api/notification-routes returns 403 PAID_REQUIRED on Community', async () => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('community');
+    const res = await request(app).get('/api/notification-routes').set('Cookie', authCookie);
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+
+  it('POST /api/notification-routes returns 403 PAID_REQUIRED on Community', async () => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('community');
+    const res = await request(app)
+      .post('/api/notification-routes')
+      .set('Cookie', authCookie)
+      .send({ name: 'x', stack_patterns: ['app'], channel_type: 'discord', channel_url: 'https://discord.com/api/webhooks/123/abc' });
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+
+  it('PUT /api/notification-routes/:id returns 403 PAID_REQUIRED on Community', async () => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('community');
+    const res = await request(app).put('/api/notification-routes/1').set('Cookie', authCookie).send({ name: 'x' });
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+
+  it('DELETE /api/notification-routes/:id returns 403 PAID_REQUIRED on Community', async () => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('community');
+    const res = await request(app).delete('/api/notification-routes/1').set('Cookie', authCookie);
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+
+  it('POST /api/notification-routes/:id/test returns 403 PAID_REQUIRED on Community', async () => {
+    vi.spyOn(licenseService, 'getTier').mockReturnValue('community');
+    const res = await request(app).post('/api/notification-routes/1/test').set('Cookie', authCookie);
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+});
+
 // --- Agents Auth (now requires authMiddleware) ---
 
 describe('Agents endpoints - auth enforcement', () => {

backend/src/routes/dashboard.ts

@@ -17,7 +17,7 @@ export interface ConfigurationStatus {
   notifications: {
     agents: { discord: AgentStatus; slack: AgentStatus; webhook: AgentStatus };
     alertRules: number;
-    routingRules: { count: number; enabledCount: number; locked: boolean; requiredTier: 'admiral' };
+    routingRules: { count: number; enabledCount: number; locked: boolean; requiredTier: 'skipper' };
   };
   automation: {
     autoHeal: { total: number; enabled: number };
@@ -101,8 +101,8 @@ export function buildLocalConfigurationStatus(
       routingRules: {
         count: notifRoutes.length,
         enabledCount: notifRoutes.filter(r => r.enabled).length,
-        locked: !isAdmiral,
-        requiredTier: 'admiral',
+        locked: !isPaid,
+        requiredTier: 'skipper',
       },
     },
     automation: {

backend/src/routes/notifications.ts

@@ -4,7 +4,7 @@ import { NotificationService, ALL_NOTIFICATION_CATEGORIES } from '../services/No
 import type { NotificationCategory } from '../services/NotificationService';
 import { NodeRegistry } from '../services/NodeRegistry';
 import { authMiddleware } from '../middleware/auth';
-import { requireAdmin, requireAdmiral } from '../middleware/tierGates';
+import { requireAdmin, requirePaid } from '../middleware/tierGates';
 import {
   NOTIFICATION_CHANNEL_TYPES,
   validateHttpsUrl,
@@ -114,7 +114,7 @@ export const notificationRoutesRouter = Router();
 
 notificationRoutesRouter.get('/', authMiddleware, (req: Request, res: Response): void => {
   if (!requireAdmin(req, res)) return;
-  if (!requireAdmiral(req, res)) return;
+  if (!requirePaid(req, res)) return;
   try {
     const routes = DatabaseService.getInstance().getNotificationRoutes();
     res.json(routes);
@@ -126,7 +126,7 @@ notificationRoutesRouter.get('/', authMiddleware, (req: Request, res: Response):
 
 notificationRoutesRouter.post('/', authMiddleware, async (req: Request, res: Response): Promise<void> => {
   if (!requireAdmin(req, res)) return;
-  if (!requireAdmiral(req, res)) return;
+  if (!requirePaid(req, res)) return;
   try {
     const { name, node_id: rawNodeId, stack_patterns, label_ids, categories, channel_type, channel_url, priority, enabled } = req.body;
 
@@ -183,7 +183,7 @@ notificationRoutesRouter.post('/', authMiddleware, async (req: Request, res: Res
 
 notificationRoutesRouter.put('/:id', authMiddleware, async (req: Request, res: Response): Promise<void> => {
   if (!requireAdmin(req, res)) return;
-  if (!requireAdmiral(req, res)) return;
+  if (!requirePaid(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'route ID');
     if (id === null) return;
@@ -259,7 +259,7 @@ notificationRoutesRouter.put('/:id', authMiddleware, async (req: Request, res: R
 
 notificationRoutesRouter.delete('/:id', authMiddleware, (req: Request, res: Response): void => {
   if (!requireAdmin(req, res)) return;
-  if (!requireAdmiral(req, res)) return;
+  if (!requirePaid(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'route ID');
     if (id === null) return;
@@ -276,7 +276,7 @@ notificationRoutesRouter.delete('/:id', authMiddleware, (req: Request, res: Resp
 
 notificationRoutesRouter.post('/:id/test', authMiddleware, async (req: Request, res: Response): Promise<void> => {
   if (!requireAdmin(req, res)) return;
-  if (!requireAdmiral(req, res)) return;
+  if (!requirePaid(req, res)) return;
   try {
     const id = parseIntParam(req, res, 'id', 'route ID');
     if (id === null) return;