Entitlements

📄️Entitlements enforcement

The single plan-enforcement layer — plan resolution, overrides, live usage counts, gate ordering on every gated endpoint, and the 402/403/428 error contract.