feat(auth): add subscription tier enforcement middleware with granular feature gates

[Darkdruce]

Closes #767

Centralises subscription tier enforcement into a reusable middleware.

• Declarative FEATURE_GATES config maps route patterns to minimum required tiers
• withTierEnforcement(requiredTier, handler) re-reads tier from Supabase on every request (not JWT cache) — single indexed SELECT for <5ms overhead
• Returns 402 Payment Required with { error, upgradeUrl: '/pricing' } when tier is insufficient
• Returns 401 for unauthenticated requests
• Tier order: free < pro < enterprise
• Tests cover all tier boundaries, 402 upgrade response, DB re-read assertion, and unauthenticated path

[drips-wave]

@Darkdruce Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits