feat(cdn): CDN/media architecture alignment (edition/plan gating + Assets↔CDN + upsell)

[ABB65]

CDN/Media architecture alignment — edition/plan gating + Assets↔CDN integration + plan upsell

Implements the layered-gate review (single shared CDN service for content + assets, confirmed). Builds on #67/#69/#70/#71/#72.

1. Edition + plan-aware nav gating

CDN ("CDN Delivery") and Assets sidebar items were shown for any project with content (no edition/plan gate) → Community + lower plans saw non-functional panels. Now resolved via useFeature(...) (edition requires_ee and plan): CDN → cdn.delivery, Assets → media.library.

2. Assets panel ↔ CDN-state awareness

The Assets panel was blind to CDN activation. When cdn_enabled = false it now shows a notice — "assets need CDN on to be served / API-reached; uploads stay private until then" — with a Go to CDN settings → action. Surfaces the activation requirement the routes enforce.

3. String reframe (CDN = content + assets)

• cdn.description: "Deliver content and assets via CDN…"
• cdn.keys_info: explains scopes — delivery serves content, media scopes power the asset API.

4. Plan-CTA discoverability (a2)

For workspaces that can self-serve upgrade (managed billing) but whose plan lacks the feature, the nav item now renders locked (lock affordance) and opens the plan modal on click — discoverable upsell instead of a hidden feature. Community + operator-set plans (no self-serve billing) still hide it. Logic: show = available || hasManagedBilling, locked = !available.

Model decisions

• Single activation (cdn_enabled) for the shared CDN service (content + assets) — confirmed.
• Internal library management stays available anytime (build the library, banner warns); external delivery + media API require activation (fix(media): gate the media API on CDN activation (cdn_enabled) #72). So the session upload is intentionally not gated on cdn_enabled — gating it would conflict with the banner model.
• Coupling (media ↔ cdn.delivery) is benign — both Starter+, no media-only-plan lockout.

Three-layer gate, now consistent

edition (useFeature / provider-null) → plan (useFeature / hasFeature, + upsell when upgradable) → activation (cdn_enabled; content + assets + API uniform).

typecheck + lint clean; 689 tests green.