refactor: rename Personal Pro to Skipper and Team Pro to Admiral (#256)

Align paid tier names with Sencho's nautical identity. Internal variant
values ('personal'/'team') remain unchanged in code, database, and
Lemon Squeezy integration — only user-facing display names updated.

- Backend: requireTeamPro → requireAdmiral, TEAM_PRO_REQUIRED → ADMIRAL_REQUIRED
- Frontend: TeamProGate.tsx → AdmiralGate.tsx, TierBadge labels updated
- Website: PricingSection tier names and nautical descriptions
- Docs: all 11 affected pages renamed, nautical footnote added to licensing

docs/features/sso.mdx

@@ -4,10 +4,10 @@ description: Authenticate with your existing identity provider - LDAP, Google, G
 ---
 
 <Note>
-  SSO requires a Sencho **Team Pro** license. Personal Pro and Community Edition do not include this feature.
+  SSO requires a Sencho **Admiral** license. Skipper and Community Edition do not include this feature.
 </Note>
 
-Sencho Team Pro lets your team sign in using existing identity providers instead of managing separate credentials. SSO works **alongside** password authentication - it does not replace it.
+Sencho Admiral lets your team sign in using existing identity providers instead of managing separate credentials. SSO works **alongside** password authentication - it does not replace it.
 
 ## Supported providers
 
@@ -173,7 +173,7 @@ If not set, Sencho auto-detects the URL from the request's `Host` header and pro
 - **State parameter** - A cryptographic random value protects against CSRF attacks on the OAuth callback
 - **Encrypted secrets** - LDAP bind passwords and OIDC client secrets are encrypted at rest with AES-256-GCM
 - **No local password** - SSO users are created with an unusable password hash. They cannot bypass SSO by using the password login form
-- **Admin-only configuration** - Only Team Pro administrators can enable or configure SSO providers
+- **Admin-only configuration** - Only Admiral administrators can enable or configure SSO providers
 
 ## Troubleshooting