feat: enforce account usage limits

JobTrackerApi/Controllers/AuthController.cs

@@ -73,7 +73,6 @@ public sealed class AuthController : ControllerBase
     public sealed record TwoFactorRequiredResult(bool RequiresTwoFactor, string PendingToken);
     public sealed record GoogleLinkDto(bool Linked, string? Email, DateTimeOffset? LinkedAt);
     public sealed record MicrosoftLinkDto(bool Linked, string? Email, DateTimeOffset? LinkedAt);
-    public sealed record EntitlementsDto(bool AdvancedAi, bool PremiumThemes, bool Automation, bool Analytics, long StorageBytes);
     public sealed record MeResult(
         string Provider,
         string? Id,
@@ -87,7 +86,7 @@ public sealed class AuthController : ControllerBase
         string? AvatarImageDataUrl,
         IList<string> Roles,
         string Plan,
-        EntitlementsDto Entitlements,
+        AccountEntitlements Entitlements,
         GoogleLinkDto? GoogleLink,
         MicrosoftLinkDto? MicrosoftLink);
     private const int MaxAvatarBytes = 1_000_000;
@@ -397,7 +396,7 @@ public sealed class AuthController : ControllerBase
             AvatarImageDataUrl: null,
             Roles: Array.Empty<string>(),
             Plan: "free",
-            Entitlements: BuildEntitlements(Array.Empty<string>()),
+            Entitlements: AccountPlans.ForRoles(Array.Empty<string>()),
             GoogleLink: provider == "google" ? new GoogleLinkDto(false, email, null) : null,
             MicrosoftLink: provider == "microsoft" ? new MicrosoftLinkDto(false, email, null) : null));
     }
@@ -910,15 +909,9 @@ public sealed class AuthController : ControllerBase
         return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
     }
 
-    private static EntitlementsDto BuildEntitlements(IList<string> roles)
-    {
-        var premium = roles.Contains("Premium", StringComparer.OrdinalIgnoreCase) || roles.Contains("Admin", StringComparer.OrdinalIgnoreCase);
-        return new EntitlementsDto(premium, premium, premium, premium, premium ? 5_000_000_000 : 250_000_000);
-    }
-
     private static MeResult ToMeResult(ApplicationUser user, IList<string> roles)
     {
-        var entitlements = BuildEntitlements(roles);
+        var entitlements = AccountPlans.ForRoles(roles);
         return new MeResult(
             Provider: "local",
             Id: user.Id,