feat(sso): split SSO providers by delivery model across tiers (#754)

Custom OIDC stays on Community so self-hosters can wire any spec-compliant
OIDC identity provider (Authelia, Keycloak, Authentik, Zitadel, and others).
Google, GitHub, and Okta one-click presets move to Skipper. LDAP / Active
Directory and scoped RBAC are Admiral-only.

Backend enforces the split via a new requireTierForSsoProvider helper in
middleware/tierGates.ts, applied after requireAdmin in all four ssoConfig
mutation handlers. GET /sso/config (list) stays ungated so downgraded
admins can still see previously-configured providers. Invalid provider ids
now 400 before the tier check to avoid leaking tier information.

Frontend adds a compact mode to PaidGate and AdmiralGate for inline
list-item locks, and SSOSection reorders the provider cards as
Custom OIDC > Google > GitHub > Okta > LDAP to reinforce the
free-to-paid progression.

Stale 'SSO is Admiral' copy in AdmiralGate, PaidGate, and the Admiral
upgrade card on the License settings page has been replaced to reflect the
new split. User-facing licensing, SSO, overview, quickstart, and security
docs have been updated with the per-tier provider matrix.

docs/features/licensing.mdx

@@ -21,20 +21,31 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
 
 ### Feature breakdown
 
+**Community** includes:
+- Unlimited nodes, compose editor, global logs, app store, alerts, and more
+- Two-factor authentication (TOTP)
+- Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC identity provider)
+
 **Skipper** includes everything in Community, plus:
 - Fleet View with drill-down
 - Webhooks and stack labels
 - Atomic deployments and fleet-wide backups
 - Auto-update policies
+- One-click Google, GitHub, and Okta SSO presets
 
 **Admiral** includes everything in Skipper, plus:
 - Unlimited admin and viewer accounts
 - Scoped RBAC (deployer, node-admin, auditor roles)
-- SSO, audit log, and host console
+- LDAP / Active Directory authentication
+- Audit log and host console
 - API tokens and private registries
 - Notification routing
 - Scheduled operations
 
+<Tip>
+  **SSO is available on every tier.** Community users can integrate any OIDC-compliant identity provider through the Custom OIDC option. Paid tiers add turnkey presets (Google, GitHub, Okta) and LDAP / Active Directory.
+</Tip>
+
 ## Free trial
 
 Every new Sencho installation starts with a **14-day Skipper trial**. No license key or credit card is required. Skipper features like fleet management, webhooks, atomic deployments, and auto-update policies are unlocked during the trial so you can evaluate them with your real infrastructure. Admiral-exclusive features (SSO, audit log, host console, scoped RBAC, unlimited accounts) require an Admiral license.