feat: open security basics, manual fleet ops, and basic fleet management to Community (#930)

Realign tier guards to the user-stated philosophy: Community covers
deploy/monitor at scale plus security basics, Skipper adds automation
and advanced fleet management, Admiral keeps enterprise control.

Community now includes:
- Trivy install / uninstall / update from the Settings Hub (admin role)
- CVE suppressions CRUD (admin role; replicates fleet-wide)
- Manual image scan with vuln, secret, and misconfig results
- Stack-config scan, scan comparison
- Manual fleet snapshots: create, list, view, restore, delete
- Per-node Sencho self-update (Check Updates + per-node Update)
- Fleet Overview search, sort, filters, node-card expand, auto-refresh

Stays paid:
- Scan policies with block_on_deploy enforcement (Skipper+)
- SBOM (SPDX, CycloneDX), SARIF export (Skipper+)
- Bulk Update All across the fleet (Skipper+)
- Scheduled snapshot create (now Skipper, was Admiral)
- Trivy auto-update toggle, fleet-wide policy push (Admiral)

The Settings -> Security tab is unhidden by setting the registry tier to
null. The SecuritySection no longer early-returns a PaidGate; the policy
list, Add Policy button, and policy dialogs are wrapped in {isPaid && }.
The Fleet view drops isPaid gates on the Snapshots tab, Check Updates
button, per-node update handlers, OverviewToolbar grid controls, the
NodeCard expand affordance, and the auto-refresh notice. The
NodeUpdatesSheet receives a canBulkUpdate prop and gates the Update All
button on it. useFleetUpdateStatus and useFleetPolling drop their isPaid
guards so polling runs for Community; useFleetOverview drops the isPaid
wrap on the filter and sort path.

Backend route guards are flipped per the matrix above. The scheduler
tick and requireScheduledTaskTier add 'snapshot' to the Skipper+ branch.
Backend test assertions are inverted for the now-Community endpoints
and a positive Skipper-snapshot-task test is added.

Documentation across features/, api-reference/, and operations/ is
updated to reflect the new tier mapping.

docs/features/vulnerability-scanning.mdx

@@ -3,7 +3,7 @@ title: "Vulnerability Scanning"
 description: "Scan container images for known CVEs, surface severity badges in the Resources Hub, and alert on policy violations."
 ---
 
-Sencho integrates with [Trivy](https://trivy.dev) to scan container images for known vulnerabilities (CVEs), surface severity badges next to your images, and alert when a scan result exceeds a configured threshold. On-demand scanning is available on every tier; automation, policies, and SBOM generation are Skipper and Admiral.
+Sencho integrates with [Trivy](https://trivy.dev) to scan container images for known vulnerabilities (CVEs), surface severity badges next to your images, and alert when a scan result exceeds a configured threshold. Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are all available on every tier. Skipper and Admiral add automation, policy enforcement, and compliance exports.
 
 <Frame>
   <img src="/images/vulnerability-scanning/resources-badges.png" alt="Resources Hub showing vulnerability severity badges next to image tags" />
@@ -21,17 +21,20 @@ The Trivy CLI must be available on the machine running Sencho. Trivy is not bund
 
 | Feature | Community | Skipper | Admiral |
 |---------|:---------:|:-------:|:-------:|
-| On-demand image scanning | ✓ | ✓ | ✓ |
+| Install / update / uninstall Trivy from Settings | ✓ | ✓ | ✓ |
+| On-demand image scanning (vulnerabilities) | ✓ | ✓ | ✓ |
 | Severity badges in the Resources Hub | ✓ | ✓ | ✓ |
 | Scan results drawer with vulnerability table | ✓ | ✓ | ✓ |
 | Post-deploy automated scanning | ✓ | ✓ | ✓ |
+| Secret detection in image filesystems | ✓ | ✓ | ✓ |
+| Compose file misconfiguration scanning | ✓ | ✓ | ✓ |
+| Scan history and comparison | ✓ | ✓ | ✓ |
+| CVE suppressions | ✓ | ✓ | ✓ |
 | Scheduled fleet scans (all images on a node) | | ✓ | ✓ |
-| Scan policies (warning and critical alerts) | | ✓ | ✓ |
+| Scan policies with `block_on_deploy` enforcement | | ✓ | ✓ |
 | SBOM generation (SPDX, CycloneDX) | | ✓ | ✓ |
-| Scan history and comparison | | ✓ | ✓ |
-| Secret detection in image filesystems | | ✓ | ✓ |
-| Compose file misconfiguration scanning | | ✓ | ✓ |
 | SARIF export (code scanning integration) | | ✓ | ✓ |
+| Auto-update of the managed Trivy binary | | | ✓ |
 
 ## On-demand scanning