feat(billing): implement tenant subscription entitlements system (milestones 0-6)

control/api/tests/s3_permissions_awscli_env_gated.rs

@@ -0,0 +1,36 @@
+use std::{path::PathBuf, process::Command};
+
+fn repo_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(|p| p.parent())
+        .expect("api crate should live under repo root")
+        .to_path_buf()
+}
+
+fn is_enabled() -> bool {
+    std::env::var("CONTROL_TEST_AWSCLI")
+        .ok()
+        .is_some_and(|v| v.trim() == "1")
+}
+
+#[test]
+fn s3_docs_permissions_can_be_verified_with_aws_cli() {
+    if !is_enabled() {
+        eprintln!("skipping: set CONTROL_TEST_AWSCLI=1 to enable aws-cli S3 permission checks");
+        return;
+    }
+
+    let script = repo_root().join("docker/scripts/s3_verify_docs.sh");
+    let out = Command::new("sh")
+        .arg(script)
+        .output()
+        .expect("failed to run s3_verify_docs.sh (requires aws cli and S3_* env)");
+
+    assert!(
+        out.status.success(),
+        "s3 verify script failed: {}\n{}",
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+}