fix: surface vuln_scanning across licence, staff and pricing UI

The catalogue row alone was not enough; the feature was invisible in
three places and mislabelled in a fourth.

PlanConfigurator rendered every key that was not "console" as "Single
sign-on", so the staff checkbox granting vulnerability scanning was
labelled single sign-on. Feature wording was duplicated between the staff
configurator and the purchase form and the copies had drifted, so it now
lives in adminsite/lib/features.ts and both read from it.

The customer licence panel showed raw keys; it now labels them.

Pricing gains a comparison row. The add-on block with a monthly price is
deliberately NOT added: that is a pricing decision, and the Paddle price
IDs for the new catalogue rows have to be pasted in before it can be sold
anyway.

site/app/pricing/page.tsx

@@ -21,6 +21,7 @@ const COMPARISON: [string, string, string, string][] = [
     ["Audit history", "30 days", "365 days", "Forever"],
     ["Browser console", "Not Available", "Add-on", "Add-on"],
     ["Single sign-on", "Not Available", "Add-on", "Add-on"],
+    ["Vulnerability scanning", "Not Available", "Add-on", "Add-on"],
     ["Support", "Community", "Email, 24/5", "Email and phone, 24/7"],
     ["Cloud term", "Annual, £0", "Monthly or annual", "Monthly or annual"],
     ["Self-hosted term", "Annual, £0", "Annual", "Annual"],
@@ -79,7 +80,7 @@ export default function PricingPage() {
                         <li>3 servers included, add as many as you like</li>
                         <li>Unlimited monitors, secrets and channels</li>
                         <li>365 days of audit history</li>
-                        <li>Browser console and single sign-on as add-ons</li>
+                        <li>Browser console, single sign-on and vulnerability scanning as add-ons</li>
                         <li>Email support, 24/5</li>
                     </ul>
                     <Link className="btn btn--solid" href="/start">