feat(shared): gate paid features from one entitlement source

Desktop, web, mobile, and the API each decided locally what a tier could do,
so a plan change could unlock a feature on one surface and not another.
Entitlement checks now live in `@d3ro/core` and are exercised by tests.

The shared theme and design-system packages also gain the tokens the new
surfaces consume, and the api-client exposes the dictionary and team types
the clients now send.

packages/ui/src/components/ds/PhysicalButton.tsx

@@ -102,8 +102,8 @@ export function PhysicalButton({
             width: 24,
             height: 24,
             borderRadius: '50%',
-            bgcolor: isAccent ? 'rgba(255, 255, 255, 0.18)' : d3roPalette.bg.inset,
-            border: `1px solid ${isAccent ? 'rgba(255, 255, 255, 0.2)' : d3roPalette.border.subtle}`,
+            bgcolor: isAccent ? 'var(--d3-overlay-strong)' : d3roPalette.bg.inset,
+            border: `1px solid ${isAccent ? 'var(--d3-overlay-strong)' : d3roPalette.border.subtle}`,
             display: 'flex',
             alignItems: 'center',
             justifyContent: 'center',