feat(server): entitlement primitive (#14964)

#### PR Dependency Tree


* **PR #14964** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added entitlement resolution to validate licenses and derive plan,
quotas, expiry and flags.
* Introduced persistent quota/entitlement state for users and workspaces
with legacy sync behavior.
* Real-time quota-state operations and change events for monitoring
usage.

* **Chores**
  * Updated workspace dependencies to add cryptography/hash crates.

* **Tests**
* Added native entitlement tests covering validation, quantity handling,
and signature/expiry cases.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14964)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/native/Cargo.toml

@@ -15,10 +15,12 @@ affine_common = { workspace = true, features = [
   "napi",
   "ydoc-loader",
 ] }
+aes-gcm = { workspace = true }
 anyhow = { workspace = true }
 base64-simd = { workspace = true }
 chrono = { workspace = true }
 file-format = { workspace = true }
+hex = { workspace = true }
 image = { workspace = true }
 infer = { workspace = true }
 jsonschema = "0.46"
@@ -30,6 +32,7 @@ matroska = { workspace = true }
 mp4parse = { workspace = true }
 napi = { workspace = true, features = ["async", "serde-json"] }
 napi-derive = { workspace = true }
+p256 = { workspace = true }
 rand = { workspace = true }
 reqwest = { version = "0.13.3", default-features = false, features = [
   "blocking",
@@ -38,6 +41,7 @@ reqwest = { version = "0.13.3", default-features = false, features = [
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+sha2 = { workspace = true }
 sha3 = { workspace = true }
 tiktoken-rs = { workspace = true }
 url = { workspace = true }