docs: fix and annotate research links after link check

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/research/notes/n8n-feature-feasibility.md

@@ -57,7 +57,7 @@ Several "gated" capabilities have free near-equivalents. Pruning and concurrency
 - External backend hooks are registered with `EXTERNAL_HOOK_FILES`. They are plain JS files that run server-side and include hooks such as `n8n.ready` and `frontend.settings` — [n8n docs: external hooks](https://docs.n8n.io/hosting/configuration/external-hooks) [V, via search summary]. External hooks are not on the CE exclusion list, and a community member reports they work without a license key — [community thread, 2026-03/04](https://community.n8n.io/t/question-about-sso-via-custom-hooks-and-sul-compliance/283373) [V]
 - A NixOS deployment puts n8n behind oauth2-proxy with Kanidm. An external hook logs users in automatically from the `X-Email` header. The hook code is not shown — [git.thalheim.io dotfiles](https://git.thalheim.io/janet/dotfiles/src/branch/main/machines/eve/modules/n8n) [V, via search summary]
 - `cweagans/n8n-oidc` describes itself as "bolt-on OIDC support for n8n" (JavaScript). An aggregator lists its last push as 2025-12-29 with 2 open issues. I did not check this on GitHub — [GitTrend](https://gittrend.io/repo/cweagans/n8n-oidc) [V, aggregator]. A forum reply also names `n8n-oidc` and `n8n-community-sso`. A search for the latter found no such project — [community thread](https://community.n8n.io/t/question-about-sso-via-custom-hooks-and-sul-compliance/283373) [V]
-- Proxy-gateway SSO is a known pattern: Authelia, Authentik, Pomerium, or Cloudflare Access enforce IdP MFA and groups before a request reaches n8n. n8n's own login still applies unless a hook maps the header to a session — [lumadock guide](https://lumadock.com/tutorials/n8n-sso-options) (403 on fetch; content seen only as a search summary) [V-partial]. Header trust is safe only if the backend is reachable solely through the proxy — [Authelia nginx docs](https://gitea.unej.ac.id/techies/authelia/raw/commit/bd5bb497e3cbcb6c54f1b150db70a97564e6b6ee/docs/proxies/nginx.md) [V, via search]
+- Proxy-gateway SSO is a known pattern: Authelia, Authentik, Pomerium, or Cloudflare Access enforce IdP MFA and groups before a request reaches n8n. n8n's own login still applies unless a hook maps the header to a session — [lumadock guide](https://lumadock.com/tutorials/n8n-sso-options) (403 on fetch; content seen only as a search summary) [V-partial]. Header trust is safe only if the backend is reachable solely through the proxy — [Authelia nginx docs](https://www.authelia.com/integration/proxies/nginx/) [V, via search]
 - Git backup and sync community tooling: n8n.io template 12721 offers bidirectional GitHub sync. It detects new, edited, renamed, and deleted workflows, runs a daily backup, and has a manual restore path — [n8n template 12721](https://n8n.io/workflows/12721-back-up-and-restore-n8n-workflows-with-github-sync/). Template 7304 does backups with change detection and name-based filenames — [n8n template 7304](https://n8n.io/workflows/7304-automated-workflow-backup-with-intelligent-change-detection-using-github/). The forum's "Ultimate GitHub ↔ n8n Workflow Backup System" adds a UI and lets you import from any commit — [community.n8n.io](https://community.n8n.io/t/the-ultimate-github-n8n-workflow-backup-system-with-ui-and-commit-level-visibility/181003). `wapad/n8n-data-manager` is a shell script that backs up and restores workflows, credentials, and env to GitHub — [ecosyste.ms topic](https://repos.ecosyste.ms/topics/workflow-backup) [V, via search]
 - [K] CLI: `n8n export:workflow --all --separate --backup --output=dir/`, `n8n export:credentials --all [--decrypted]`, `n8n import:workflow --separate --input=dir/`, `n8n import:credentials`. Public REST API (`/api/v1/workflows`, `/executions`, `/credentials`, `/tags`) with `X-N8N-API-KEY`, available on CE. Security audit with `n8n audit` CLI / `POST /api/v1/audit` (risk report, not an event log). Logging with `N8N_LOG_LEVEL` and `N8N_LOG_OUTPUT=console,file`, `N8N_LOG_FILE_LOCATION`. Credential overwrites with `CREDENTIALS_OVERWRITE_DATA` (JSON per credential type) or `CREDENTIALS_OVERWRITE_ENDPOINT`. Docker secrets through `_FILE`-suffixed env vars. Queue mode with `EXECUTIONS_MODE=queue` plus Redis (`QUEUE_BULL_REDIS_*`) and `n8n worker` processes. Error Workflow (Error Trigger node) is free.
 
@@ -129,7 +129,7 @@ Most "open-core" alternatives gate the same enterprise set as n8n: SSO, RBAC, au
 
 ### Cited Findings
 - **Windmill** Community Edition caps SSO users at 10, users at 50, workspaces at 3, and groups at 4. Git sync works for up to 2 users. There are no audit logs, no external secret backends (Vault/AKV/AWS SM), no multiplayer, no agent workers, no worker-group management UI, no autoscaling, and no concurrency limits. SAML and SCIM are Enterprise — [Windmill pricing](https://www.windmill.dev/pricing) [V]. The license is not stated on the pricing page. [K] The core is AGPLv3, with EE features under a proprietary license.
-- **Activepieces** pricing: Free $0 (1,000 credits, 5 users), Plus $20/mo, Team $200/mo (25 users, SSO and standard roles), Ultimate custom (SCIM, custom RBAC, audit logs, secret managers, Git sync/releases, branding), Embed from $36k/yr — [Activepieces pricing](https://www.activepieces.com/pricing) [V]. The core is MIT; enterprise code is under a commercial license — [Activepieces license docs](https://www.activepieces.com/docs/about/license) [V, via search]. Sources disagree on whether CE lacks projects, SSO, audit, and Git sync (third-party summary) or has "all features" (vendor editions page) — [editions](https://activepieces.com/docs/about/editions) [V, conflicting]
+- **Activepieces** pricing: Free $0 (1,000 credits, 5 users), Plus $20/mo, Team $200/mo (25 users, SSO and standard roles), Ultimate custom (SCIM, custom RBAC, audit logs, secret managers, Git sync/releases, branding), Embed from $36k/yr — [Activepieces pricing](https://www.activepieces.com/pricing) [V]. The core is MIT; enterprise code is under a commercial license — [Activepieces license docs](https://www.activepieces.com/docs/about/license) [V, via search]. Sources disagree on whether CE lacks projects, SSO, audit, and Git sync (third-party summary) or has "all features" (vendor editions page) — [editions](https://www.activepieces.com/docs/about/license) [V, conflicting]
 - **Kestra** OSS is Apache 2.0 at $0 and includes Git integration/versioning. Enterprise adds SSO (OIDC, LDAP, SCIM), RBAC, audit logs, secrets managers, multi-tenancy, worker groups, and namespace-level secrets/variables. It is sold as an annual per-instance subscription with no listed price — [Kestra pricing](https://kestra.io/pricing) [V]
 - [K, not re-verified] **Node-RED**: Apache-2.0, no paid tier in core. Its multi-user/auth support is basic (admin auth with a passport strategy allows OIDC/OAuth). FlowFuse sells team and enterprise features. **Huginn**: MIT, fully free, multi-user, aging. **Automatisch**: AGPL-3.0 core with enterprise features under a commercial license (SSO/SAML gated). **Apache Airflow**: Apache-2.0, all features free (RBAC, OAuth/LDAP via FAB auth manager, logs to remote stores), but it is code-first, not low-code. **Temporal**: MIT server, all features free self-hosted (Temporal Cloud is paid); code-first.
 - This part of the research (search-engine results only) found no reporting of an n8n fork that unlocks enterprise features — [search results summary](https://jimmysong.io/en/blog/n8n-deep-dive/) [V, negative result]. The licensing research did find that such forks exist; see [n8n-licensing-legal.md §7](n8n-licensing-legal.md) (they are not named).