feat(membership): enforce tenant subscription plans with blocked UI

Add configurable membership plans (free/plus/pro) synced to DB on boot, a
subscription guard middleware that blocks tenant endpoints on expired or
missing plans, and a MembershipBlockedView that surfaces the reason so
the admin can contact the tenant owner. Quota and brand-library reads now
honor the active plan's policy JSON and expired subscriptions.

server/internal/tenant/transport/auth_handler.go

@@ -20,6 +20,7 @@ func NewAuthHandler(a *bootstrap.App) *AuthHandler {
 	return &AuthHandler{
 		svc: app.NewAuthService(
 			repository.NewAuthRepository(a.DB),
+			repository.NewTenantPlanRepository(a.DB),
 			a.KolProfiles,
 			a.JWT,
 			a.Sessions,