feat(sso): split SSO providers by delivery model across tiers (#754)

Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.

docs/features/licensing.mdx

@@ -21,20 +21,31 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
 
 ### Feature breakdown
 
+**Community** includes:
+- Unlimited nodes, compose editor, global logs, app store, alerts, and more
+- Two-factor authentication (TOTP)
+- Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC identity provider)
+
 **Skipper** includes everything in Community, plus:
 - Fleet View with drill-down
 - Webhooks and stack labels
 - Atomic deployments and fleet-wide backups
 - Auto-update policies
+- One-click Google, GitHub, and Okta SSO presets
 
 **Admiral** includes everything in Skipper, plus:
 - Unlimited admin and viewer accounts
 - Scoped RBAC (deployer, node-admin, auditor roles)
-- SSO, audit log, and host console
+- LDAP / Active Directory authentication
+- Audit log and host console
 - API tokens and private registries
 - Notification routing
 - Scheduled operations
 
+<Tip>
+  **SSO is available on every tier.** Community users can integrate any OIDC-compliant identity provider through the Custom OIDC option. Paid tiers add turnkey presets (Google, GitHub, Okta) and LDAP / Active Directory.
+</Tip>
+
 ## Free trial
 
 Every new Sencho installation starts with a **14-day Skipper trial**. No license key or credit card is required. Skipper features like fleet management, webhooks, atomic deployments, and auto-update policies are unlocked during the trial so you can evaluate them with your real infrastructure. Admiral-exclusive features (SSO, audit log, host console, scoped RBAC, unlimited accounts) require an Admiral license.

docs/features/overview.mdx

@@ -89,7 +89,7 @@ Create viewer accounts with read-only access to dashboards, logs, and file conte
 
 ## SSO & LDAP authentication
 
-Authenticate with your existing identity provider. Sencho supports LDAP/Active Directory, Google, GitHub, and Okta. SSO works alongside password authentication and auto-provisions accounts on first login with configurable role mapping. Admiral only. [Learn more →](/features/sso)
+Authenticate with your existing identity provider. Custom OIDC (Authelia, Keycloak, Authentik, any spec-compliant OIDC provider) is available on every tier. Skipper adds one-click Google, GitHub, and Okta presets. Admiral adds LDAP / Active Directory for enterprise directories. SSO works alongside password authentication and auto-provisions accounts on first login with configurable role mapping. [Learn more →](/features/sso)
 
 ## Atomic deployments
 

docs/features/sso.mdx

@@ -3,17 +3,21 @@ title: SSO & LDAP Authentication
 description: Authenticate with your existing identity provider, including LDAP, Google, GitHub, Okta, and any spec-compliant OIDC provider.
 ---
 
-Sencho lets your team sign in using existing identity providers instead of managing separate credentials. SSO works **alongside** password authentication; it does not replace it. SSO is available in all Sencho editions, including Community.
+Sencho lets your team sign in using existing identity providers instead of managing separate credentials. SSO works **alongside** password authentication; it does not replace it. SSO is available in every Sencho edition; higher tiers add turnkey presets and enterprise directory support.
 
 ## Supported providers
 
-| Provider | Protocol | Notes |
-|----------|----------|-------|
-| **LDAP / Active Directory** | LDAP bind + search | Works with OpenLDAP, Active Directory, FreeIPA, and any LDAPv3 server |
-| **Google** | OpenID Connect | Google Workspace or personal Google accounts |
-| **GitHub** | OAuth 2.0 | GitHub personal accounts and GitHub orgs |
-| **Okta** | OpenID Connect | Any Okta org or Okta-compatible IdP |
-| **Custom OIDC** | OpenID Connect | Any spec-compliant OIDC provider: Keycloak, Authentik, Authelia, Zitadel, KanIDM, Pocket ID, and more |
+| Provider | Protocol | Tier | Notes |
+|----------|----------|------|-------|
+| **Custom OIDC** | OpenID Connect | Community | Any spec-compliant OIDC provider: Authelia, Keycloak, Authentik, Zitadel, KanIDM, Pocket ID, and more |
+| **Google** | OpenID Connect | Skipper | One-click preset for Google Workspace or personal Google accounts |
+| **GitHub** | OAuth 2.0 | Skipper | One-click preset for GitHub personal accounts and GitHub orgs |
+| **Okta** | OpenID Connect | Skipper | One-click preset for any Okta org or Okta-compatible IdP |
+| **LDAP / Active Directory** | LDAP bind + search | Admiral | Works with OpenLDAP, Active Directory, FreeIPA, and any LDAPv3 server |
+
+<Tip>
+  **Self-hosters on the Community tier** can still integrate Google, GitHub, Okta, or any other identity provider by using the Custom OIDC option pointed at the provider's discovery endpoint. The paid-tier presets add one-click configuration and provider-specific defaults; the underlying protocol is the same.
+</Tip>
 
 ## How it works
 

docs/getting-started/sso-quickstart.mdx

@@ -5,6 +5,10 @@ description: Step-by-step instructions for connecting Sencho to your identity pr
 
 SSO can be configured via environment variables (shown below) or from the Settings UI after first boot.
 
+<Note>
+  **Tier availability.** Custom OIDC is available on every tier, including Community. The Google, GitHub, and Okta one-click presets require Skipper or higher. LDAP / Active Directory requires Admiral. See [Licensing & Billing](/features/licensing#feature-breakdown) for the full breakdown.
+</Note>
+
 ## Google OIDC
 
 1. Go to the [Google Cloud Console](https://console.cloud.google.com/apis/credentials)

docs/security.mdx

@@ -64,7 +64,9 @@ Every Sencho instance includes the foundational security stack. Advanced access-
 | Feature | Community | Skipper | Admiral |
 |---------|:---------:|:-------:|:-------:|
 | Password authentication | ✓ | ✓ | ✓ |
-| SSO (LDAP, Google, GitHub, Okta, Custom OIDC) | ✓ | ✓ | ✓ |
+| Custom OIDC SSO (Authelia, Keycloak, Authentik, any provider) | ✓ | ✓ | ✓ |
+| One-click Google / GitHub / Okta SSO | | ✓ | ✓ |
+| LDAP / Active Directory | | | ✓ |
 | Two-factor authentication (TOTP + backup codes) | ✓ | ✓ | ✓ |
 | Session management (httpOnly, Secure, SameSite) | ✓ | ✓ | ✓ |
 | Encryption at rest (AES-256-GCM) | ✓ | ✓ | ✓ |
@@ -86,7 +88,11 @@ Changing your password immediately invalidates all other active sessions, so a c
 
 ## Single sign-on
 
-Sencho supports five identity providers: **LDAP/Active Directory**, **Google**, **GitHub**, **Okta**, and any **Custom OIDC** provider (Keycloak, Authentik, Authelia, Zitadel, KanIDM, Pocket ID, and others). SSO is available on every tier, including Community.
+Sencho supports five identity providers split across tiers by delivery model:
+
+- **Community**: **Custom OIDC**, which connects to any spec-compliant OpenID Connect provider (Authelia, Keycloak, Authentik, Zitadel, KanIDM, Pocket ID, and others).
+- **Skipper**: one-click presets for **Google**, **GitHub**, and **Okta**.
+- **Admiral**: **LDAP / Active Directory** for on-premises directories.
 
 All OIDC flows use PKCE (Proof Key for Code Exchange) and a cryptographic state parameter to prevent authorization code interception and cross-site request forgery. SSO credentials (client secrets and LDAP bind passwords) are encrypted at rest with AES-256-GCM.