feat(membership): enforce tenant subscription plans with blocked UI

Add configurable membership plans (free/plus/pro) synced to DB on boot, a
subscription guard middleware that blocks tenant endpoints on expired or
missing plans, and a MembershipBlockedView that surfaces the reason so
the admin can contact the tenant owner. Quota and brand-library reads now
honor the active plan's policy JSON and expired subscriptions.

server/internal/tenant/transport/workspace_handler.go

@@ -21,6 +21,7 @@ func NewWorkspaceHandler(a *bootstrap.App) *WorkspaceHandler {
 				repository.NewTemplateRepository(a.DB),
 				a.Cache,
 			),
+			repository.NewQuotaRepository(a.DB),
 		).WithCache(a.Cache),
 	}
 }