feat(membership): enforce tenant subscription plans with blocked UI

Add configurable membership plans (free/plus/pro) synced to DB on boot, a
subscription guard middleware that blocks tenant endpoints on expired or
missing plans, and a MembershipBlockedView that surfaces the reason so
the admin can contact the tenant owner. Quota and brand-library reads now
honor the active plan's policy JSON and expired subscriptions.

apps/admin-web/src/router/index.ts

@@ -15,6 +15,14 @@ const router = createRouter({
         descriptionKey: "route.login.description",
       },
     },
+    {
+      path: "/membership-blocked",
+      name: "membership-blocked",
+      component: () => import("@/views/MembershipBlockedView.vue"),
+      meta: {
+        requiresAuth: true,
+      },
+    },
     {
       path: "/",
       component: () => import("@/layouts/AppShell.vue"),
@@ -223,11 +231,22 @@ router.beforeEach(async (to) => {
     };
   }
 
+  if (authStore.isAuthenticated && authStore.isMembershipBlocked && to.name !== "membership-blocked") {
+    return { name: "membership-blocked" };
+  }
+
+  if (to.name === "membership-blocked" && authStore.isAuthenticated && !authStore.isMembershipBlocked) {
+    return { name: "workspace" };
+  }
+
   if (to.meta.requiresKol && !authStore.isActiveKol) {
     return { name: "workspace" };
   }
 
   if (to.name === "login" && authStore.isAuthenticated) {
+    if (authStore.isMembershipBlocked) {
+      return { name: "membership-blocked" };
+    }
     return { name: "workspace" };
   }