feat(security): move managed Trivy auto-update to Skipper tier (#1150)

* feat(security): move managed Trivy auto-update to Skipper tier

Drop the gate on the managed Trivy auto-update toggle from Admiral to
Skipper so it lives alongside the rest of Sencho's automation features
(auto-heal, scheduled ops, per-stack image auto-update, scan policies)
instead of behind the enterprise-control tier.

Backend: `PUT /api/security/trivy-auto-update` switches from
`requireAdmiral` to `requirePaid`. The 24h scheduler tick in
SchedulerService that reads the setting is tier-neutral and picks the
new gate up automatically.

Frontend: SecuritySection.tsx swaps the inline `isAdmiral` conditional
on the toggle render for `isPaid`. The local `isAdmiral` derivation and
the `useLicense` import become unused and are removed.

Docs: licensing, overview, vulnerability-scanning matrix, trivy-setup,
and the settings reference now read Skipper consistently for this
feature.

* fix(security): require admin role on trivy-auto-update toggle

Independent audit of the prior commit flagged that PUT
/api/security/trivy-auto-update had no admin-role guard. The route was
authenticated and tier-gated, but the global /api authGate only
authenticates and `requirePaid` only checks tier. Any paid viewer could
flip the global trivy_auto_update setting via a direct API call.

Add `requireAdmin` ahead of `requirePaid`, matching the pattern used by
every other mutating route in this file (sbom, policies, suppressions,
misconfig-acks).

Add route tests covering paid admin allowed, paid viewer rejected,
community admin rejected, and unauthenticated rejected.

docs/features/licensing.mdx

@@ -47,6 +47,7 @@ For larger deployments, an **Enterprise** tier is available with custom pricing,
 - Auto-heal policies
 - Scheduled operations across the full action catalog (lifecycle, updates, scans, snapshots, prune)
 - Scan policies with `block_on_deploy` deploy enforcement, SBOM (SPDX, CycloneDX), and SARIF export
+- Auto-update of the managed Trivy binary
 - Bulk actions on a label (deploy, stop, or restart every stack tagged with it)
 - Remote OTA node updates from the control instance
 - Fleet Actions (bulk update all, bulk restart Sencho)
@@ -64,7 +65,6 @@ For larger deployments, an **Enterprise** tier is available with custom pricing,
 - Private and custom registry credentials
 - Sencho Mesh (cross-node container networking)
 - Sencho Cloud Backup
-- Auto-update of the managed Trivy binary
 
 ## Free trial
 

docs/features/overview.mdx

@@ -159,7 +159,7 @@ Generate scoped API tokens for CI/CD pipelines, scripts, and automation workflow
 
 ### Vulnerability scanning
 
-Scan container images for known CVEs with [Trivy](https://trivy.dev). Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are available on every tier; scheduled scans, scan policies that gate deploys, SBOM generation, and SARIF export are available on Skipper and Admiral. Auto-update of the managed Trivy binary is Admiral. [Learn more →](/features/vulnerability-scanning)
+Scan container images for known CVEs with [Trivy](https://trivy.dev). Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are available on every tier; scheduled scans, scan policies that gate deploys, SBOM generation, and SARIF export are available on Skipper and Admiral. Auto-update of the managed Trivy binary is Skipper. [Learn more →](/features/vulnerability-scanning)
 
 ### CVE suppressions
 

docs/features/vulnerability-scanning.mdx

@@ -36,7 +36,7 @@ The Trivy CLI must be available on the machine running Sencho. Trivy is not bund
 | Scan policies with `block_on_deploy` enforcement |  | ✓ | ✓ |
 | SBOM generation (SPDX, CycloneDX) |  | ✓ | ✓ |
 | SARIF export (code scanning integration) |  | ✓ | ✓ |
-| Auto-update of the managed Trivy binary |  |  | ✓ |
+| Auto-update of the managed Trivy binary |  | ✓ | ✓ |
 
 ## On-demand scanning