…terminal_tier (DOG-26)

Today every tier including Team returns upgrade_url="https://instanode.dev/pricing/".
Team is the top of the rank ladder — there is nothing to upgrade to.
SDKs/dashboards rendering an Upgrade CTA on the Team plan show a button
that loops back to the pricing page with no action.

Now: top-rank tier emits upgrade_url=null + is_terminal_tier=true. Every
other tier keeps the pricing URL + is_terminal_tier=false. Clients can
suppress the Upgrade CTA via the boolean (or "URL is null" check)
without string-matching "team" — adding an enterprise tier above team
tomorrow Just Works.

Done via rank-iterating the live registry (capabilities.go computes
terminalRank as entries[len-1].rank after the rank sort), so the contract
is anchored to plans.Rank, not to a hardcoded tier name.

OpenAPI: upgrade_url is now ["string", "null"]; is_terminal_tier is a
required boolean. Both schema changes are non-breaking — existing clients
that read upgrade_url as a string get null for Team only.

Coverage block:
  Symptom:        upgrade_url for terminal tier (Team) loops to pricing
  Enumeration:    grep upgrade_url + UpgradeURL in api/internal/handlers/
                  for capabilities-specific sites (1 emit + 1 test + 1 openapi)
  Sites found:    3
  Sites touched:  3 (capabilities.go emit, capabilities_test.go assert,
                  openapi.go schema + required list)
  Coverage test:  TestCapabilities_TerminalTierUpgradeURLIsNull —
                  registry-iterating (rule 18): asserts entries[len-1]
                  has IsTerminalTier=true + UpgradeURL=nil, and every
                  other tier is the inverse. Adding a new top tier
                  automatically shifts the assertion target.
  Live verified:  pending merge + auto-deploy + curl /api/v1/capabilities
                  | jq '.tiers[] | {tier, upgrade_url, is_terminal_tier}'

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>