Product entitlements catalog (Phase 1: schema + admin + buy page)

Closes the request to make entitlements first-class on products
instead of free-text strings on policies. Operators declare the
closed list of entitlements a product offers — slug + display name
+ optional description — and policies pick from that list with a
click-to-toggle bubble UI. Buy page renders human-readable names
("AI summaries") with descriptions as tooltips, never the raw slug
("ai_summaries").

Schema (migration 0014):
- products.entitlements_catalog_json: nullable JSON column shaped
  as [{slug, name, description}, ...]
- Auto-backfill on upgrade: for each existing product, derive a
  catalog from the union of its policies' entitlement slugs, with
  name = slug.replace('_', ' ') and empty description. Operators
  can refine afterward.
- Products with no policy entitlements stay NULL (legacy
  free-text mode preserved).

Server:
- Product struct gains entitlements_catalog: Option<Vec<EntitlementDef>>
- repo::set_product_entitlements_catalog (validates lowercase ASCII
  slugs, uniqueness, defaults name to slug if empty)
- Product create/update API accept entitlements_catalog;
  update uses double-Option PATCH shape so operators can clear
- Closed-list validation: when product has a non-empty catalog,
  policy create + update reject any entitlement slug not in the
  catalog with a clear error pointing at the right path
- /v1/products/<slug>/policies surfaces entitlements_catalog
  in the product object so SDK consumers can render display
  names client-side
- Buy page renders entitlement display names + description tooltips
  on tier cards (falls back to raw slug for legacy entries that
  predate the catalog)

Admin UI:
- New catalogEditor() helper (repeating slug/name/description rows
  with add/remove buttons) embedded in product create + edit forms
- New entitlementBubblePicker() helper (click-to-toggle pill chips
  showing display name with description tooltip)
- Policy create form: entitlements input swaps based on the chosen
  product's catalog — bubble picker when catalog has entries,
  legacy textarea otherwise. Rebuilds when operator changes
  product.
- Policy edit modal: same bubble-picker-or-textarea swap, scoped
  to the policy's product
- Policy list table: entitlement column shows display names
  (resolved against the product's catalog) instead of slugs

Migration regression test verifies:
- Backfill correctly unions entitlements across all of a product's
  policies, deduplicates, applies name = slug-with-underscores-as-
  spaces transformation
- Products with no policy entitlements get NULL (not [])
- Manually-set catalog values round-trip
- Schema is otherwise FK-clean post-migration

Test count: 78 (was 77; +1 for migration_0014_backfills_*).

Phase 2 (SDK updates + integration doc + side-by-side card-grid
policy authoring UI) ships in follow-up commits before v0.2.0:8.

licensing-service/src/models.rs

@@ -27,10 +27,34 @@ pub struct Product {
     pub active: bool,
     /// Arbitrary JSON metadata the developer can attach.
     pub metadata: serde_json::Value,
+    /// Per-product entitlements catalog (migration 0014). Defines the
+    /// closed list of entitlement slugs the product offers, with
+    /// human-readable display names + descriptions used by the buy
+    /// page and SDK consumers. None = "free-text mode" (legacy
+    /// behavior); operators can opt-in by adding rows.
+    #[serde(default)]
+    pub entitlements_catalog: Option<Vec<EntitlementDef>>,
     pub created_at: String,
     pub updated_at: String,
 }
 
+/// One entry in a product's entitlements catalog. Operator defines
+/// these once per product; policies reference them by slug.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct EntitlementDef {
+    /// Stable identifier — what gets baked into the signed license
+    /// payload + checked by the SDK's `hasEntitlement(slug)` calls.
+    /// Must be ASCII, lowercase, no spaces (operator's responsibility).
+    pub slug: String,
+    /// Human-readable label rendered on the buy page tier cards
+    /// (e.g. "AI summaries"). Falls back to the slug if empty.
+    pub name: String,
+    /// Optional one-sentence description shown as a tooltip / sub-line
+    /// on the buy page. Empty when operator hasn't filled it in.
+    #[serde(default)]
+    pub description: String,
+}
+
 fn default_currency() -> String {
     "SAT".to_string()
 }