feat(server): entitlement primitive (#14964)

#### PR Dependency Tree


* **PR #14964** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added entitlement resolution to validate licenses and derive plan,
quotas, expiry and flags.
* Introduced persistent quota/entitlement state for users and workspaces
with legacy sync behavior.
* Real-time quota-state operations and change events for monitoring
usage.

* **Chores**
  * Updated workspace dependencies to add cryptography/hash crates.

* **Tests**
* Added native entitlement tests covering validation, quantity handling,
and signature/expiry cases.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/toeverything/AFFiNE/pull/14964)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/common/realtime/src/index.ts

@@ -34,6 +34,14 @@ export interface RealtimeRequestMap {
     };
     output: { task: unknown | null };
   };
+  'user.quota-state.get': {
+    input: Record<string, never>;
+    output: { state: unknown };
+  };
+  'workspace.quota-state.get': {
+    input: { workspaceId: string };
+    output: { state: unknown };
+  };
 }
 
 export type NotificationCountChangedReason =
@@ -87,6 +95,14 @@ export interface RealtimeTopicMap {
       error?: string;
     };
   };
+  'user.quota-state.changed': {
+    input: Record<string, never>;
+    event: { changed: true };
+  };
+  'workspace.quota-state.changed': {
+    input: { workspaceId: string };
+    event: { changed: true };
+  };
 }
 
 export type RealtimeRequestInputOf<Op extends RealtimeRequestName> =