feat(tenancy): a project ceiling per plan, and copy for the backend's error codes

[basb7]

Seats already had a plan ceiling. This adds projects, stops there, and fixes the frontend gap that made the addition visible.

Every ceiling is scoped to an organization

That is the whole shape: an organization is where a subscription lives, so anything a plan limits is something an organization contains. Organization.plan answers all of it and nothing new has to hold a subscription.

_LIMITS = {
    Plan.COMMUNITY: {"seats": None, "projects": None},
    Plan.FREE:      {"seats": 3,    "projects": 1},
    Plan.STARTER:   {"seats": 5,    "projects": 10},
    Plan.TEAM:      {"seats": 25,   "projects": None},
}

How many organizations somebody creates is deliberately not limited. An empty one holds no projects, no flags and no traffic, so metering them would be metering nothing.

And the moment you do limit them, the model needs an owner to count against — Organization has none, and an ADMIN membership is not a substitute: being invited to administer somebody else's organization would consume your own allowance. An earlier revision of this branch had an Account model and that ceiling; it was removed once the ownership question surfaced. Flagsmith does not limit organizations either.

Flags, environments, conditions and rules have no entry, on purpose. A limit that does not exist is not written down as None in twenty places — it simply has no check.

The check

Shares a transaction with the insert and locks the organization row first, the same shape as the seat check on invitation accept. Without it two concurrent creates both observe "one below the limit" and both commit.

SQLite ignores select_for_update silently, so that protection is only real on PostgreSQL — which is what CI and any deployment run. Said in the code so nobody reads a green local suite as proof of it.

The plan is never accepted from the request: the serializer already marks it read-only and the model defaults it, so upgrading cannot be a field in a POST body.

One setting is the whole difference between the editions

unset                           COMMUNITY — projects and seats unlimited
DEFAULT_ORGANIZATION_PLAN=FREE  1 project, 3 seats

Declared in both compose files with the override shape compose.yml already uses, so the default is visible without reading Python:

DEFAULT_ORGANIZATION_PLAN=${DEFAULT_ORGANIZATION_PLAN:-COMMUNITY}

A literal FREE in compose.dev.yml was tried and removed: it would have limited every development environment to one project, which is the opposite of what a self-hosted install is for.

An unrecognised value raises ImproperlyConfigured naming the four it accepts, rather than falling through to something.

The frontend gap this exposed

Endpoints that distinguish their failures answer with a machine code, and api.ts surfaces it as the error's message — on purpose, since copy should not be a backend deploy. But the translation was one switch in the invitation page; everywhere else showed the code itself, and nothing failed when a code had none.

So project_limit_reached shipped in the first commit with no copy, and a person hitting the ceiling would have read exactly that.

ERROR_COPY is now one table and errorCopy() reads it. An unmapped code is returned as it arrived rather than replaced with something generic: a "please try again" throws away the only information anybody had, and the person most likely to see a raw code is whoever just added it. A screen with a better meaning of its own passes a fallback — the invitation page still says the link is dead, because there it is.

Kept complete by a test that walks the backend's Python for {"error": "..."} and fails naming any code with no copy, and any copy for a code the backend cannot send. Verified it discriminates: removing one entry fails the run and names it.

Wired into the four screens that receive these codes: project creation, member removal, invitation accept, password reset.

Verified

Backend	603 passed on SQLite, 603 on PostgreSQL 18
Frontend	108 passed, lint clean, build clean
Compose	docker compose config resolves to COMMUNITY unset and FREE overridden, in both files