feat: vuln_scanning entitlement and documentation

Adds license.FeatureVulnScanning as the one name for the feature and a
catalogue row per deployment/tier, following console and oidc: features
are opt-in per customer, so no plan bundles it.

Documents the subsystem in CLAUDE.md, including that ScopedCollections is
the canonical registry instance deletion derives from — there is no
separate deletion list, which the plan had wrong.

server/internal/services/packages.go

@@ -6,22 +6,21 @@ import (
 
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/db"
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/models"
+	"gitea.hostxtra.co.uk/mrhid6/vantage/shared/license"
 	"go.mongodb.org/mongo-driver/v2/bson"
 	"go.mongodb.org/mongo-driver/v2/mongo"
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
-// FeatureVulnScanning is the licence feature name gating package collection.
-const FeatureVulnScanning = "vuln_scanning"
-
 // VulnScanningEnabled reports whether this instance may collect packages.
 //
-// It reads the feature by name and never switches on tier, so changing what a
-// tier includes needs no server release. A lapsed licence collects nothing:
-// there is no point accumulating inventory an instance cannot act on.
+// It reads the feature by name from shared/license and never switches on tier,
+// so changing what a tier includes needs no server release. A lapsed licence
+// collects nothing: there is no point accumulating inventory an instance cannot
+// act on.
 func VulnScanningEnabled(instanceID string) bool {
 	st := GetLicenseState(instanceID)
-	return st.Active() && st.Feature(FeatureVulnScanning)
+	return st.Active() && st.Feature(license.FeatureVulnScanning)
 }
 
 // HasPackageHash reports whether we already hold this exact package set, which