feat(membership): enforce tenant subscription plans with blocked UI

Add configurable membership plans (free/plus/pro) synced to DB on boot, a
subscription guard middleware that blocks tenant endpoints on expired or
missing plans, and a MembershipBlockedView that surfaces the reason so
the admin can contact the tenant owner. Quota and brand-library reads now
honor the active plan's policy JSON and expired subscriptions.

apps/admin-web/src/stores/auth.ts

@@ -65,6 +65,8 @@ export const useAuthStore = defineStore("auth", () => {
   }
 
   const isAuthenticated = computed(() => Boolean(accessToken.value && user.value));
+  const membership = computed(() => user.value?.membership ?? null);
+  const isMembershipBlocked = computed(() => Boolean(membership.value?.blocked));
   const kolProfile = computed(() => user.value?.kol_profile ?? null);
   const isActiveKol = computed(() => kolProfile.value?.status === "active");
 
@@ -74,6 +76,8 @@ export const useAuthStore = defineStore("auth", () => {
     user,
     initialized,
     isAuthenticated,
+    membership,
+    isMembershipBlocked,
     kolProfile,
     isActiveKol,
     bootstrap,