feat: Plan-based feature permissions and quota enforcement

Backend:
- Add HasQuota() permission factory for quota limits (resources, users, services, appointments, email templates, automated tasks)
- Add HasFeaturePermission() factory for feature-based permissions (SMS, masked calling, custom domains, white label, plugins, webhooks, calendar sync, analytics)
- Add has_feature() method to Tenant model for flexible permission checking
- Add new tenant permission fields: can_create_plugins, can_use_webhooks, can_use_calendar_sync, can_export_data
- Create Data Export API with CSV/JSON support for appointments, customers, resources, services
- Create Analytics API with dashboard, appointments, revenue endpoints
- Add calendar sync views and URL configuration

Frontend:
- Add usePlanFeatures hook for checking feature availability
- Add UpgradePrompt components (inline, banner, overlay variants)
- Add LockedSection wrapper and LockedButton for feature gating
- Update settings pages with permission checks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/hooks/useBusiness.ts

@@ -49,6 +49,22 @@ export const useCurrentBusiness = () => {
         paymentsEnabled: data.payments_enabled ?? false,
         // Platform-controlled permissions
         canManageOAuthCredentials: data.can_manage_oauth_credentials || false,
+        // Plan permissions (what features are available based on subscription)
+        planPermissions: data.plan_permissions || {
+          sms_reminders: false,
+          webhooks: false,
+          api_access: false,
+          custom_domain: false,
+          white_label: false,
+          custom_oauth: false,
+          plugins: false,
+          export_data: false,
+          video_conferencing: false,
+          two_factor_auth: false,
+          masked_calling: false,
+          pos_system: false,
+          mobile_app: false,
+        },
       };
     },
   });

frontend/src/hooks/usePlanFeatures.ts

@@ -0,0 +1,112 @@
+/**
+ * Plan Features Hook
+ *
+ * Provides utilities for checking feature availability based on subscription plan.
+ */
+
+import { useCurrentBusiness } from './useBusiness';
+import { PlanPermissions } from '../types';
+
+export type FeatureKey = keyof PlanPermissions;
+
+export interface PlanFeatureCheck {
+  /**
+   * Check if a feature is available in the current plan
+   */
+  canUse: (feature: FeatureKey) => boolean;
+
+  /**
+   * Check if any of the features are available
+   */
+  canUseAny: (features: FeatureKey[]) => boolean;
+
+  /**
+   * Check if all of the features are available
+   */
+  canUseAll: (features: FeatureKey[]) => boolean;
+
+  /**
+   * Get the current plan tier
+   */
+  plan: string | undefined;
+
+  /**
+   * All plan permissions
+   */
+  permissions: PlanPermissions | undefined;
+
+  /**
+   * Whether permissions are still loading
+   */
+  isLoading: boolean;
+}
+
+/**
+ * Hook to check plan feature availability
+ */
+export const usePlanFeatures = (): PlanFeatureCheck => {
+  const { data: business, isLoading } = useCurrentBusiness();
+
+  const canUse = (feature: FeatureKey): boolean => {
+    if (!business?.planPermissions) {
+      // Default to false if no permissions loaded yet
+      return false;
+    }
+    return business.planPermissions[feature] ?? false;
+  };
+
+  const canUseAny = (features: FeatureKey[]): boolean => {
+    return features.some(feature => canUse(feature));
+  };
+
+  const canUseAll = (features: FeatureKey[]): boolean => {
+    return features.every(feature => canUse(feature));
+  };
+
+  return {
+    canUse,
+    canUseAny,
+    canUseAll,
+    plan: business?.plan,
+    permissions: business?.planPermissions,
+    isLoading,
+  };
+};
+
+/**
+ * Feature display names for UI
+ */
+export const FEATURE_NAMES: Record<FeatureKey, string> = {
+  sms_reminders: 'SMS Reminders',
+  webhooks: 'Webhooks',
+  api_access: 'API Access',
+  custom_domain: 'Custom Domain',
+  white_label: 'White Label',
+  custom_oauth: 'Custom OAuth',
+  plugins: 'Custom Plugins',
+  export_data: 'Data Export',
+  video_conferencing: 'Video Conferencing',
+  two_factor_auth: 'Two-Factor Authentication',
+  masked_calling: 'Masked Calling',
+  pos_system: 'POS System',
+  mobile_app: 'Mobile App',
+};
+
+/**
+ * Feature descriptions for upgrade prompts
+ */
+export const FEATURE_DESCRIPTIONS: Record<FeatureKey, string> = {
+  sms_reminders: 'Send automated SMS reminders to customers and staff',
+  webhooks: 'Integrate with external services using webhooks',
+  api_access: 'Access the SmoothSchedule API for custom integrations',
+  custom_domain: 'Use your own custom domain for your booking site',
+  white_label: 'Remove SmoothSchedule branding and use your own',
+  custom_oauth: 'Configure your own OAuth credentials for social login',
+  plugins: 'Create custom plugins to extend functionality',
+  export_data: 'Export your data to CSV or other formats',
+  video_conferencing: 'Add video conferencing links to appointments',
+  two_factor_auth: 'Require two-factor authentication for enhanced security',
+  masked_calling: 'Use masked phone numbers to protect privacy',
+  pos_system: 'Process in-person payments with Point of Sale',
+  mobile_app: 'Access SmoothSchedule on mobile devices',
+};