feat(shared): gate paid features from one entitlement source

Desktop, web, mobile, and the API each decided locally what a tier could do,
so a plan change could unlock a feature on one surface and not another.
Entitlement checks now live in `@d3ro/core` and are exercised by tests.

The shared theme and design-system packages also gain the tokens the new
surfaces consume, and the api-client exposes the dictionary and team types
the clients now send.

packages/ui-native/src/components/MetalCard.tsx

@@ -20,7 +20,7 @@ export function MetalCard({ children, inset = false, style, ...rest }: MetalCard
     borderColor: palette.border.subtle,
     overflow: 'hidden',
     // RN 그림자
-    shadowColor: palette.shadow ?? '#000',
+    shadowColor: palette.shadow,
     shadowOffset: { width: 0, height: 4 },
     shadowOpacity: inset ? 0 : 0.25,
     shadowRadius: inset ? 0 : 8,