fix(admin): licence and plan features serialise as [], never null

Free has no features, so a nil Go slice served "features": null. The
portal's type said string[], called .length on it, and took the page down.

The guarantee lives on a named Features type with its own MarshalJSON
rather than at each of the six places a licence or plan is serialised,
because the seventh is the one that would have been forgotten. Applying it
at marshal time also fixes rows already holding null in Mongo, which a
write-side fix alone would not.

Same class, found while checking the rest: staffListInstances built its
expiring filter from a nil []string, marshalling to $in: null, which Mongo
rejects — so the quiet week when nothing is expiring is precisely when the
staff Operations page's own query would have failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/api/staff.go

@@ -122,7 +122,11 @@ func staffListInstances(c *gin.Context) {
 	}
 	if c.Query("expiring") == "true" {
 		// Instances whose licence expires within 14 days, for renewal chasing.
-		var ids []string
+		//
+		// Empty rather than nil: a nil slice marshals to `$in: null`, which
+		// Mongo rejects outright, so the quiet week when nothing is expiring is
+		// exactly when this query would have failed.
+		ids := []string{}
 		cur, err := db.Admin("licenses").Find(c.Request.Context(), bson.M{
 			"superseded_by": bson.M{"$exists": false},
 			"expires_at":    bson.M{"$lt": time.Now().UTC().Add(14 * 24 * time.Hour)},
@@ -401,7 +405,7 @@ func staffUpdatePlan(c *gin.Context) {
 	set := bson.M{
 		"name":              body.Name,
 		"limits":            body.Limits,
-		"features":          body.Features,
+		"features":          body.Features.OrEmpty(),
 		"paddle_product_id": body.PaddleProductID,
 		"paddle_price_ids":  body.PaddlePriceIDs,
 		"active":            body.Active,