feat: Adds getAllByEnrollmentAndTier

[sandsinh]

Summary

Adds GET /sites/by-tier/:tier admin endpoint to list sites enrolled at a given entitlement tier (PAID, FREE_TRIAL, or PLG), with optional productCode query parameter (e.g. LLMO) to narrow the result.

• New controller getAllByEnrollmentAndTier calls Site.allByEnrollmentAndTier(tier, productCode) (admin-only via hasAdminAccess()), validates tier against CUSTOMER_VISIBLE_TIERS, and serializes via SiteDto.
• Wires the route in src/routes/index.js and grants site:read capability for S2S consumers in src/routes/required-capabilities.js.
• Documents the endpoint and a new tier path parameter + productCode query parameter in the OpenAPI specs, with a 400 response example.
• Bumps @adobe/spacecat-shared-data-access to expose the new model method.
• Drive-by: adds the missing resolveWwwUrl mock to three nested esmock blocks in test/controllers/plg/plg-onboarding.test.js so admin/Slack-notification/admin-update tests no longer time out (pre-existing failure on main).

Related Issues

SITES-43769

Test plan

• Unit tests for the controller (admin auth, missing/invalid tier, success path with and without productCode)
• Route handler test verifies GET /sites/by-tier/:tier is registered
• routeRequiredCapabilities coverage assertion passes
• npm run docs:lint passes
• Verify against a deployed environment with a known tiered org

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

This PR will trigger a minor release when merged.