feat(shared): gate paid features from one entitlement source

Desktop, web, mobile, and the API each decided locally what a tier could do,
so a plan change could unlock a feature on one surface and not another.
Entitlement checks now live in `@d3ro/core` and are exercised by tests.

The shared theme and design-system packages also gain the tokens the new
surfaces consume, and the api-client exposes the dictionary and team types
the clients now send.

packages/core/src/index.ts

@@ -6,6 +6,7 @@ export * from './types'
 export * from './errors'
 export * from './ipc-channels'
 export * from './constants'
+export * from './entitlement'
 export * from './utils/crypto-license'
 export * from './utils/pii-redactor'
 export * from './utils/secure-memory'