feat(server): entitlement primitive (#14964)

#### PR Dependency Tree


* **PR #14964** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added entitlement resolution to validate licenses and derive plan,
quotas, expiry and flags.
* Introduced persistent quota/entitlement state for users and workspaces
with legacy sync behavior.
* Real-time quota-state operations and change events for monitoring
usage.

* **Chores**
  * Updated workspace dependencies to add cryptography/hash crates.

* **Tests**
* Added native entitlement tests covering validation, quantity handling,
and signature/expiry cases.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14964)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/native/index.d.ts

@@ -641,6 +641,47 @@ export interface RerankCandidate {
   text: string
 }
 
+export interface ResolvedEntitlement {
+  plan: string
+  valid: boolean
+  status: string
+  quantity?: number
+  expiresAt?: string
+  subjectId?: string
+  targetId?: string
+  recurring?: string
+  issuedAt?: string
+  entity?: string
+  issuer?: string
+  quota: ResolvedQuota
+  flags: Record<string, boolean>
+  errorCode?: string
+  errorMessage?: string
+}
+
+export interface ResolvedQuota {
+  blobLimit: number
+  storageQuota: number
+  seatLimit?: number
+  seatQuota?: number
+  historyPeriod: number
+  copilotActionLimit?: number
+}
+
+export interface ResolveEntitlementInput {
+  deploymentType: string
+  targetType: string
+  targetId?: string
+  plan?: string
+  quantity?: number
+  signedPayload?: Buffer
+  publicKey?: string
+  licenseAesKey?: string
+  now: string
+}
+
+export declare function resolveEntitlementV1(input: ResolveEntitlementInput): ResolvedEntitlement
+
 export declare function runNativeActionRecipePreparedStream(input: ActionRuntimeInput, callback: ((err: Error | null, arg: string) => void)): LlmStreamHandle
 
 export declare function safeFetch(request: SafeFetchRequest): Promise<SafeFetchResponse>