Cap connectors with inbound webhooks per Cloud plan (#1393) - #1612

Summary

Cloud plans now cap how many active connectors may receive inbound webhooks, as decided in #1393: Starter 1, Team and the trial 5, Business and Enterprise no limit. The cap uses the plan caps from #1601/#1602 and follows PLAN_CAPS_ENFORCE: dry-run (the default) only logs, on refuses with the usual 403 PLAN_LIMIT. Self-hosted has no cap.

Stacked on #1602 (feat/plan-caps). Merge after #1601 to #1603.

Changes

• license/plan-caps.ts: new webhooks axis and webhookConnectorCap(plan, override). A licence feature maxWebhookConnectors overrides the plan, so a customer can get more by arrangement. An unknown plan is not capped.
• license/license-guard.service.ts: checkCanEnableWebhook(organizationId) counts active connectors of the organization with webhookEnabled and calls refuseOverCap. The trial is soft like the paid plans, not hard.
• connectors/connectors.controller.ts: checked on PUT /api/connectors/:id only when webhookEnabled goes from off to on, before anything is saved, and on POST /api/connectors when a connector is created with webhooks on. Turning webhooks off, or leaving them on, is never checked.
• Docs: docs/cloud-plans.md (table row, how it counts, the new axis in the 403) and docs/operations/observability.md (the Cloud difference). llms-full.txt regenerated.
• No FitAxis in plan-fit.ts and no UI copy: the plan picker and the paywall notice (Show what Starter changes before checkout, and swap at the plan cap #1603) do not mention webhooks yet. That can follow once Show what Starter changes before checkout, and swap at the plan cap #1603 is in.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

New tests:

• plan-caps.guard.spec.ts: caps per plan and the override; dry-run logs [plan caps dry-run] would refuse webhooks … and allows; on refuses at the cap with PLAN_LIMIT / axis: 'webhooks' and allows below it (Starter, Team, trial); Business, no licence and self-hosted are never capped (self-hosted does not even count).
• connectors.controller.spec.ts: off to on checks the cap before the update; a refusal saves nothing; on to on, on to off and unrelated edits never check; create checks only with webhookEnabled: true.

Commands, in packages/backend (Prisma client generated with npx prisma generate):

• npx tsc --noEmit -p tsconfig.json: exit 0
• npx jest --maxWorkers=4 src/license src/connectors src/plan-caps: 124 suites passed, 2 skipped; 2,315 tests passed, 11 skipped
• npx eslint on the 5 touched backend files: exit 0, no warnings
• From the root: node scripts/generate-llms-txt.mjs (regenerated llms-full.txt)

Cloud vs self-hosted: on Cloud the cap applies as above; on self-hosted checkCanEnableWebhook returns at once. No Prisma change. Nothing under ee/.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test): only the license, connectors and plan-caps folders were run locally; CI runs the full suite
• This PR has a descriptive title

Related Issues

Relates to #1393 (point 1), #1601, #1602, #1603, #1571.