feat(membership): enforce tenant subscription plans with blocked UI

Add configurable membership plans (free/plus/pro) synced to DB on boot, a
subscription guard middleware that blocks tenant endpoints on expired or
missing plans, and a MembershipBlockedView that surfaces the reason so
the admin can contact the tenant owner. Quota and brand-library reads now
honor the active plan's policy JSON and expired subscriptions.

deploy/config.yaml

@@ -38,6 +38,32 @@ monitoring_workers:
   result_ingest_concurrency: 4
   projection_rebuild_concurrency: 2
 
+membership:
+  default_plan_code: free
+  plans:
+    - code: free
+      name: Free
+      article_generation: 3
+      article_quota_cycle: lifetime
+      image_storage_bytes: 10485760
+      company_limit: 1
+      subscription_duration: 72h
+      contact_admin_on_expiry: true
+    - code: plus
+      name: Plus
+      article_generation: 200
+      article_quota_cycle: monthly
+      image_storage_bytes: 524288000
+      company_limit: 1
+      subscription_duration: 720h
+    - code: pro
+      name: Pro
+      article_generation: 400
+      article_quota_cycle: monthly
+      image_storage_bytes: 1073741824
+      company_limit: 2
+      subscription_duration: 720h
+
 redis:
   addr: redis:6379
   db: 0