feat(server): entitlement based model (#14996)

#### PR Dependency Tree


* **PR #14996** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Admin mutations to grant/revoke commercial entitlements.
  * New Doc comment-update permission.
  * Realtime user/workspace quota-state endpoints and live-update rooms.

* **Bug Fixes**
  * More accurate readable-doc filtering and permission evaluation.

* **Refactor**
* Workspace feature management moved to entitlement-based model;
permission and quota pipelines redesigned.
  * Admin workspace UI now edits flags only (feature toggles removed).

* **Tests**
* Extensive new and updated tests for permissions, entitlements, quota,
projection, and backfills.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14996?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/plugins/calendar/resolver.ts

@@ -11,7 +11,7 @@ import {
 import { ActionForbidden, AuthenticationRequired, Config } from '../../base';
 import { CurrentUser } from '../../core/auth';
 import { ServerConfigType } from '../../core/config/types';
-import { AccessController } from '../../core/permission';
+import { PermissionAccess } from '../../core/permission';
 import { UserType } from '../../core/user';
 import { WorkspaceType } from '../../core/workspaces';
 import { Models } from '../../models';
@@ -113,7 +113,7 @@ export class CalendarAccountResolver {
 export class WorkspaceCalendarResolver {
   constructor(
     private readonly calendar: CalendarService,
-    private readonly access: AccessController
+    private readonly access: PermissionAccess
   ) {}
 
   @ResolveField(() => [WorkspaceCalendarObjectType])
@@ -133,7 +133,7 @@ export class WorkspaceCalendarResolver {
 export class WorkspaceCalendarEventsResolver {
   constructor(
     private readonly calendar: CalendarService,
-    private readonly access: AccessController
+    private readonly access: PermissionAccess
   ) {}
 
   @ResolveField(() => [CalendarEventObjectType])
@@ -162,7 +162,7 @@ export class CalendarMutationResolver {
     private readonly calendar: CalendarService,
     private readonly oauth: CalendarOAuthService,
     private readonly models: Models,
-    private readonly access: AccessController
+    private readonly access: PermissionAccess
   ) {}
 
   @Mutation(() => String)