feat: tee entitlement model & encrypted store

[daopunk]

Summary

• Entitlements on CVM: encrypted EntitlementsStore at /data/entitlements.enc (same group-prefs-translation volume), DeriveKey path signal-bot/entitlements, plan SKUs aligned with the site catalog (+ bundle-all-alpha), CRUD / link-token bind / group claim / expiry / alpha-vs-paid composition helpers — no Stripe webhooks or command gating yet.
• Commerce landings: static /checkout/success, /checkout/cancel, and /alpha routes with shared landing helpers and tests (post-checkout !link code display; alpha explainer).
• Tracker hygiene: strip scattered issue/PR citations from product docs and code; single index at .agents/docs/github-work-index.md plus always-on Cursor rule.

Closes #53
Closes #62

Test plan

• cargo test -p signal-bot entitlements_store
• npm run ci / pnpm run ci (fmt, clippy, coverage ≥90%, commitlint)
• Confirm compose/phala set ENTITLEMENTS__STORAGE_PATH=/data/entitlements.enc on existing /data mount (no new volume)
• cd site && npm run test:unit (checkout landing specs)
• Spot-check docs: no #N outside .agents/docs/github-work-index.md and the no-issue rule’s BAD examples