fix(webapp): invalidate entitlement cache on plan changes

When setPlan transitions a customer's plan (free_connected,
updated_subscription, canceled_subscription), invalidate the new
entitlement cache alongside the existing billing cache invalidation.

Without this, a downgrade or cancellation could leave hasAccess: true
served from cache for up to 120s — meaning revoked access would
linger. Per Devin's review on the swr cache PR.

Author: ericallam

apps/webapp/app/services/platform.v3.server.ts

@@ -373,6 +373,7 @@ export async function setPlan(
       if (result.accepted) {
         // Invalidate billing cache since plan changed
         opts?.invalidateBillingCache?.(organization.id);
+        await platformCache.entitlement.remove(organization.id);
         return redirect(newProjectPath(organization, "You're on the Free plan."));
       } else {
         return redirectWithErrorMessage(
@@ -389,11 +390,13 @@ export async function setPlan(
     case "updated_subscription": {
       // Invalidate billing cache since subscription changed
       opts?.invalidateBillingCache?.(organization.id);
+      await platformCache.entitlement.remove(organization.id);
       return redirectWithSuccessMessage(callerPath, request, "Subscription updated successfully.");
     }
     case "canceled_subscription": {
       // Invalidate billing cache since subscription was canceled
       opts?.invalidateBillingCache?.(organization.id);
+      await platformCache.entitlement.remove(organization.id);
       return redirectWithSuccessMessage(callerPath, request, "Subscription canceled.");
     }
   }