feat(server): entitlement based model (#14996)

#### PR Dependency Tree


* **PR #14996** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Admin mutations to grant/revoke commercial entitlements.
  * New Doc comment-update permission.
  * Realtime user/workspace quota-state endpoints and live-update rooms.

* **Bug Fixes**
  * More accurate readable-doc filtering and permission evaluation.

* **Refactor**
* Workspace feature management moved to entitlement-based model;
permission and quota pipelines redesigned.
  * Admin workspace UI now edits flags only (feature toggles removed).

* **Tests**
* Extensive new and updated tests for permissions, entitlements, quota,
projection, and backfills.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14996?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/native/src/permission/candidates.rs

@@ -84,6 +84,10 @@ fn restricted_decision(input: &PermissionEvaluationInputV1, action: &str) -> Vec
     return Vec::new();
   }
 
+  if input.legacy_compat_mode && input.subject.allow_local && input.workspace.local {
+    return Vec::new();
+  }
+
   let mut restrictions = Vec::new();
   if !input.runtime.known {
     restrictions.push(PermissionDecisionRestrictionV1 {

packages/backend/native/src/permission/evaluator.rs

@@ -347,9 +347,12 @@ mod tests {
       local: true,
       ..Default::default()
     };
+    input.runtime.known = false;
+    input.runtime.stale = true;
     input.workspace_actions = vec!["Workspace.Delete".to_string()];
     let output = evaluate_permission(input).unwrap();
     assert!(decision(&output.workspace.decisions, "Workspace.Delete").allowed);
+    assert!(decision(&output.docs[0].decisions, "Doc.Update").allowed);
   }
 
   #[test]