feat(pricing): collapse to two tiers (#1309)

* feat(pricing): collapse to two tiers (Community + Admiral)

Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral)
to two: a generous free Community tier and a single paid Admiral tier. The
Skipper tier is removed.

Now free in Community: auto-heal, auto-update, scheduled operations,
webhooks, notification routing, Fleet Actions and bulk operations, SSO
preset providers (Google / GitHub / Okta), unlimited users with admin and
viewer roles, and deploy safety (atomic deploys, auto-rollback, and
one-click rollback).

Admiral (paid) is focused on running and governing a fleet: blueprints,
Fleet Secrets, deploy enforcement, vulnerability report export, audit log,
host console, private registries, mesh networking, node cordon, managed
cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles
(deployer, node-admin, auditor) with per-resource scoped assignments.

Internally the license variant distinction is removed so tier is binary
(community / paid). License validation still verifies the Lemon Squeezy
store and product before granting paid status.

Docs and the contributor guide are updated to the two-tier model.

* docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording

The licensing docs page kept the old Admiral pricing plus a Founder
Lifetime column and an Enterprise paragraph after the two-tier collapse.
Update it to $12/month or $99/year, drop the lifetime and Enterprise
content, and link to the pricing page for current pricing.

Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title,
and three test comments. Historical CHANGELOG entries and the
retired-Skipper license-guard test are intentionally left as-is.

* docs: align licensing and SSO pages with the two-tier model

Correct the SSO overview so the Google, GitHub, and Okta presets read as
available on every tier, matching the provider table; only LDAP and Active
Directory require Sencho Admiral. Remove the lifetime-plan references from the
licensing, settings, and troubleshooting pages so they reflect subscription-only
Admiral pricing.

* fix(rbac): omit scoped permissions from /me on the Community tier

Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case.

* docs: use custom-pricing wording on the contact page

The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.

docs/features/stack-management.mdx

@@ -129,7 +129,7 @@ When a flag is not supported, paste the partial output into the **Empty** tab as
 
 ## The stack list
 
-All discovered stacks appear in the left sidebar. The list groups stacks by label (Skipper+) and by pinned status, so the most relevant entries surface at the top.
+All discovered stacks appear in the left sidebar. The list groups stacks by label and by pinned status, so the most relevant entries surface at the top.
 
 ### Status indicator
 
@@ -163,7 +163,7 @@ Each chip carries a live count. Click **Hide filters** in the top-right of the r
 The list is grouped to keep frequently used stacks reachable.
 
 - **PINNED**: sits at the very top when at least one stack is pinned. Pin a stack with **Pin to top** in the kebab menu (`P` shortcut).
-- **Label groups**: each label produces its own collapsible section, header rendered uppercase. Labels are a Skipper+ feature; see [Stack Labels](/features/stack-labels) for color and assignment options.
+- **Label groups**: each label produces its own collapsible section, header rendered uppercase. See [Stack Labels](/features/stack-labels) for color and assignment options.
 - **UNLABELED**: bottom group with everything that has no label.
 
 Click any group header to collapse or expand it. The group's stack count appears in the header.
@@ -279,8 +279,8 @@ The stack header groups actions by frequency of use. The most common action is t
 | Primary | **Restart** | `docker compose restart` | Restarts all containers in the stack. |
 | Secondary | **Stop** | `docker compose stop` | Stops containers without removing them. State is preserved. |
 | Secondary | **Update** | `docker compose pull` + `up -d` | Pulls the latest image tags and recreates containers. |
-| Overflow | **Rollback** | Restores backup | Reverts compose and env files to the pre-deploy snapshot and redeploys. Only shown when a backup exists (Skipper+). |
-| Overflow | **Scan config** | Trivy config scan | Scans the compose file for misconfigurations (Skipper+, admin). |
+| Overflow | **Rollback** | Restores backup | Reverts compose and env files to the pre-deploy snapshot and redeploys. Only shown when a backup exists. |
+| Overflow | **Scan config** | Trivy config scan | Scans the compose file for misconfigurations (admin role). |
 | Overflow | **Delete** | `down --volumes` + removes files | Stops and removes containers and volumes, then deletes the stack directory. |
 
 **When stopped:**
@@ -316,7 +316,7 @@ Bulk mode lets you run a single lifecycle action across several stacks at once,
 - **Start**: deploys every selected stack that is currently down.
 - **Stop**: stops every selected stack that is currently running.
 - **Restart**: restarts every selected stack that is currently running.
-- **Update**: pulls the latest image tags and redeploys (Skipper+).
+- **Update**: pulls the latest image tags and redeploys.
 
 Press `B` again or toggle the bulk mode button to leave bulk mode.
 
@@ -345,13 +345,13 @@ Click the kebab on a stack row in the sidebar to open its context menu. The menu
 **inspect**
 
 - **Alerts** (`A`): open the alert rule editor for this stack. See [Alerts and Notifications](/features/alerts-notifications).
-- **Auto-Heal** (`H`): configure auto-recovery for this stack (Skipper+). See [Auto-Heal Policies](/features/auto-heal-policies).
+- **Auto-Heal** (`H`): configure auto-recovery for this stack. See [Auto-Heal Policies](/features/auto-heal-policies).
 - **Check updates** (`U`): force an image update check now.
 - **Open App** (`↗`): open the stack's web interface in a new tab. Shown only when the stack is running and exposes a web port.
 
 **organize**
 
-- **Labels** (`›`): assign or remove labels (Skipper+). See [Stack Labels](/features/stack-labels).
+- **Labels** (`›`): assign or remove labels. See [Stack Labels](/features/stack-labels).
 - **Pin to top** (`P`): pin or unpin the stack from the **PINNED** group at the top of the list.
 
 **lifecycle**
@@ -359,7 +359,7 @@ Click the kebab on a stack row in the sidebar to open its context menu. The menu
 - **Stop** (`⌘.`): shown when running.
 - **Restart** (`⌘R`): shown when running.
 - **Update** (`⌘↑`): pulls the latest image tags and redeploys.
-- **Schedule task**: open the scheduler pre-filled for this stack (Skipper+); pick **Auto-update Stack** to set up unattended image updates on your own cadence. See [Scheduled Operations](/features/scheduled-operations) and [Auto-Update Policies](/features/auto-update-policies).
+- **Schedule task**: open the scheduler pre-filled for this stack; pick **Auto-update Stack** to set up unattended image updates on your own cadence. See [Scheduled Operations](/features/scheduled-operations) and [Auto-Update Policies](/features/auto-update-policies).
 - **Deploy** (`⌘↵`): shown when stopped, in place of Stop and Restart.
 
 **destructive**
@@ -391,7 +391,3 @@ Click the **Scan stacks folder** icon button to the right of **Create Stack**. S
 ### Service action returns a "service not found" error
 
 The service name used in the action must match the `services:` key in the stack's `compose.yaml`. This error occurs when no running containers match that service name, either because the service was never deployed or because the compose file defines a different name. Verify the service key in your compose file and ensure the stack has been deployed at least once so containers exist for that service.
-
-### Bulk **Update** is missing from the action bar
-
-The bulk **Update** action is a Skipper-tier feature; on Community, it does not appear in the action bar at all. **Start**, **Stop**, and **Restart** are available on every tier.