feat(cloud): Implement Entitlements with plan features and gating middleware

[nfebe]

Task

Provide the real Entitlements implementation from plan data and gate routes by feature key.

Actions

• Add a machine-readable feature_keys array to each plan in config/cloudplans.php.
• Implement the core App\Contracts\Entitlements interface in the cloud plugin (allows / limit resolved from the user's active plan) and rebind it in the cloud service provider.
• Register a cloud.feature:{key} route middleware that calls Entitlements::allows.
• Cache the plan-to-feature and user-to-entitlement maps in Redis, invalidated on the Cashier webhook.

Acceptance

• A route behind cloud.feature:plaid returns 403 for an unentitled user and 200 for an entitled one.
• The gate costs a single cached read; no Stripe call inline.
• Disabling the cloud plugin reverts gating to the core allow-all default.