Plan / effective-tier resolution

A user's real access is their organization's subscription plan combined with their individual role, capped to whichever is lower — so an org can license one tier for its whole team without every member needing a personal subscription.

• You're deciding whether to buy one org-wide plan tier versus per-seat subscriptions
• You're debugging why a user with an 'admin' role still can't access a subscriber-only feature
• You're auditing billing logic to confirm a downgraded org plan actually restricts its members

Effective tier = min(organization's plan tier, user's individual role) — a subscriber-plan organization caps every member at subscriber features regardless of their personal role, and a normal-role user in a gb-plan org still only gets normal access.