feat(shared): gate paid features from one entitlement source

Desktop, web, mobile, and the API each decided locally what a tier could do,
so a plan change could unlock a feature on one surface and not another.
Entitlement checks now live in `@d3ro/core` and are exercised by tests.

The shared theme and design-system packages also gain the tokens the new
surfaces consume, and the api-client exposes the dictionary and team types
the clients now send.

packages/core/package.json

@@ -27,6 +27,10 @@
       "types": "./src/constants.ts",
       "default": "./src/constants.ts"
     },
+    "./entitlement": {
+      "types": "./src/entitlement.ts",
+      "default": "./src/entitlement.ts"
+    },
     "./utils/meeting-markdown": {
       "types": "./src/utils/meeting-markdown.ts",
       "default": "./src/utils/meeting-markdown.ts"