feat(server): entitlement based model (#14996)

#### PR Dependency Tree


* **PR #14996** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Admin mutations to grant/revoke commercial entitlements.
  * New Doc comment-update permission.
  * Realtime user/workspace quota-state endpoints and live-update rooms.

* **Bug Fixes**
  * More accurate readable-doc filtering and permission evaluation.

* **Refactor**
* Workspace feature management moved to entitlement-based model;
permission and quota pipelines redesigned.
  * Admin workspace UI now edits flags only (feature toggles removed).

* **Tests**
* Extensive new and updated tests for permissions, entitlements, quota,
projection, and backfills.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14996?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/common/realtime/src/index.ts

@@ -36,14 +36,56 @@ export interface RealtimeRequestMap {
   };
   'user.quota-state.get': {
     input: Record<string, never>;
-    output: { state: unknown };
+    output: { state: UserQuotaStateSnapshot };
   };
   'workspace.quota-state.get': {
     input: { workspaceId: string };
-    output: { state: unknown };
+    output: { state: WorkspaceQuotaStateSnapshot };
   };
 }
 
+export interface UserQuotaStateSnapshot {
+  userId: string;
+  plan: string;
+  sourceEntitlementId: string | null;
+  blobLimit: number;
+  storageQuota: number;
+  usedStorageQuota: number;
+  historyPeriodSeconds: number;
+  copilotActionLimit: number | null;
+  flags: Record<string, unknown>;
+  known: boolean;
+  stale: boolean;
+  lastReconciledAt: string | Date | null;
+  staleAfter: string | Date | null;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+}
+
+export interface WorkspaceQuotaStateSnapshot {
+  workspaceId: string;
+  plan: string;
+  sourceEntitlementId: string | null;
+  ownerUserId: string | null;
+  usesOwnerQuota: boolean;
+  seatLimit: number;
+  memberCount: number;
+  overcapacityMemberCount: number;
+  blobLimit: number;
+  storageQuota: number;
+  usedStorageQuota: number;
+  historyPeriodSeconds: number;
+  readonly: boolean;
+  readonlyReasons: string[];
+  flags: Record<string, unknown>;
+  known: boolean;
+  stale: boolean;
+  lastReconciledAt: string | Date | null;
+  staleAfter: string | Date | null;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+}
+
 export type NotificationCountChangedReason =
   | 'created'
   | 'read'