feat(server): entitlement based model (#14996)

#### PR Dependency Tree


* **PR #14996** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Admin mutations to grant/revoke commercial entitlements.
  * New Doc comment-update permission.
  * Realtime user/workspace quota-state endpoints and live-update rooms.

* **Bug Fixes**
  * More accurate readable-doc filtering and permission evaluation.

* **Refactor**
* Workspace feature management moved to entitlement-based model;
permission and quota pipelines redesigned.
  * Admin workspace UI now edits flags only (feature toggles removed).

* **Tests**
* Extensive new and updated tests for permissions, entitlements, quota,
projection, and backfills.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14996?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/data/migrations/1765500000000-backfill-permission-projection.ts

@@ -0,0 +1,28 @@
+import { ModuleRef } from '@nestjs/core';
+import { PrismaClient } from '@prisma/client';
+
+import { WorkspacePolicyService } from '../../core/permission/policy';
+import { Models } from '../../models';
+
+export class BackfillPermissionProjection1765500000000 {
+  static async up(_db: PrismaClient, ref: ModuleRef) {
+    const models = ref.get(Models, { strict: false });
+    await models.permissionProjection.backfillLegacyProjection();
+
+    const policy = ref.get(WorkspacePolicyService, { strict: false });
+    const workspaces = await _db.workspace.findMany({
+      select: { id: true },
+    });
+    for (const workspace of workspaces) {
+      const state = await policy.getWorkspaceState(workspace.id);
+      await models.workspaceRuntimeState.upsert(workspace.id, {
+        readonly: state.isReadonly,
+        readonlyReasons: state.readonlyReasons,
+        known: true,
+        staleAfter: null,
+      });
+    }
+  }
+
+  static async down(_db: PrismaClient) {}
+}

packages/backend/server/src/data/migrations/1765600000000-backfill-entitlement-projection.ts

@@ -0,0 +1,35 @@
+import { ModuleRef } from '@nestjs/core';
+import { PrismaClient } from '@prisma/client';
+
+import { LegacyEntitlementProjectionService } from '../../core/entitlement';
+import { QuotaStateService } from '../../core/quota/state';
+
+export class BackfillEntitlementProjection1765600000000 {
+  static async up(db: PrismaClient, ref: ModuleRef) {
+    const projection = ref.get(LegacyEntitlementProjectionService, {
+      strict: false,
+    });
+    await projection.backfillEntitlementsAndQuotaStates();
+
+    const quota = ref.get(QuotaStateService, { strict: false });
+    const [users, workspaces] = await Promise.all([
+      db.user.findMany({ select: { id: true } }),
+      db.workspace.findMany({ select: { id: true } }),
+    ]);
+
+    const tasks = [
+      ...users.map(user => () => quota.reconcileUserQuotaState(user.id)),
+      ...workspaces.map(
+        workspace => () => quota.reconcileWorkspaceQuotaState(workspace.id)
+      ),
+    ];
+    const batchSize = 16;
+    for (let index = 0; index < tasks.length; index += batchSize) {
+      await Promise.all(
+        tasks.slice(index, index + batchSize).map(task => task())
+      );
+    }
+  }
+
+  static async down(_db: PrismaClient) {}
+}

packages/backend/server/src/data/migrations/index.ts

@@ -4,3 +4,5 @@ export * from './1721299086340-refresh-unnamed-user';
 export * from './1745211351719-create-indexer-tables';
 export * from './1751966744168-correct-session-update-time';
 export * from './1763800000000-rebuild-manticore-mixed-script-indexes';
+export * from './1765500000000-backfill-permission-projection';
+export * from './1765600000000-backfill-entitlement-projection';