feat: tiered costs feature + admin tier management + tag selection

- costs: nullable notes (fix create without notes), drop renewalDate
  (schema + API + UI), gate POST/PATCH/DELETE to admin + costs feature
- feature middleware: admin-aware hasFeature + getEntitlements union;
  /auth/me and login return resolved entitlements
- users: tier enum (free/premium/enterprise) in create/update/list,
  admin UI tier select + tier badge
- tags: GET /tags/all, TagInput autocomplete in new/edit tool forms,
  feature suggestions on focus, query invalidation on create/update
- openapi: nullable ToolUpdate urls, ToolUpdate tier fields, listAllTags
- Dockerfile: push-force to drop renewal_date column

lib/api-client-react/src/generated/api.schemas.ts

@@ -34,12 +34,22 @@ export const UserRole = {
   user: 'user',
 } as const;
 
+export type UserTier = typeof UserTier[keyof typeof UserTier];
+
+
+export const UserTier = {
+  free: 'free',
+  premium: 'premium',
+  enterprise: 'enterprise',
+} as const;
+
 export interface User {
   id: number;
   username: string;
   /** @nullable */
   email?: string | null;
   role: UserRole;
+  tier?: UserTier;
   createdAt: string;
 }
 
@@ -51,6 +61,15 @@ export const UserCreateInputRole = {
   user: 'user',
 } as const;
 
+export type UserCreateInputTier = typeof UserCreateInputTier[keyof typeof UserCreateInputTier];
+
+
+export const UserCreateInputTier = {
+  free: 'free',
+  premium: 'premium',
+  enterprise: 'enterprise',
+} as const;
+
 export interface UserCreateInput {
   /** @minLength 2 */
   username: string;
@@ -58,6 +77,7 @@ export interface UserCreateInput {
   password: string;
   email?: string;
   role?: UserCreateInputRole;
+  tier?: UserCreateInputTier;
 }
 
 export type UserRoleUpdateRole = typeof UserRoleUpdateRole[keyof typeof UserRoleUpdateRole];
@@ -68,8 +88,18 @@ export const UserRoleUpdateRole = {
   user: 'user',
 } as const;
 
+export type UserRoleUpdateTier = typeof UserRoleUpdateTier[keyof typeof UserRoleUpdateTier];
+
+
+export const UserRoleUpdateTier = {
+  free: 'free',
+  premium: 'premium',
+  enterprise: 'enterprise',
+} as const;
+
 export interface UserRoleUpdate {
-  role: UserRoleUpdateRole;
+  role?: UserRoleUpdateRole;
+  tier?: UserRoleUpdateTier;
 }
 
 export interface AuditLog {
@@ -144,7 +174,9 @@ export interface ToolUpdate {
   name?: string;
   description?: string;
   category?: string;
+  /** @nullable */
   websiteUrl?: string | null;
+  /** @nullable */
   iconUrl?: string | null;
   features?: string[];
   tags?: string[];
@@ -232,6 +264,15 @@ export const AuthUserRole = {
   user: 'user',
 } as const;
 
+export type AuthUserTier = typeof AuthUserTier[keyof typeof AuthUserTier];
+
+
+export const AuthUserTier = {
+  free: 'free',
+  premium: 'premium',
+  enterprise: 'enterprise',
+} as const;
+
 export interface AuthUser {
   sub: string;
   /** @nullable */
@@ -241,7 +282,8 @@ export interface AuthUser {
   /** @nullable */
   preferredUsername?: string | null;
   role?: AuthUserRole;
-  tier?: "free" | "premium" | "enterprise";
+  tier?: AuthUserTier;
+  entitlements?: string[];
   isLocal?: boolean;
 }