feat(license): enforce max_users at user creation paths

Wires LicenseEnforcer into UserAdminController.createUser and
OidcAuthController auto-signup. Cap fires before any validation so
over-cap creates short-circuit cheaply. Audit emission already
present (LicenseEnforcer 3-arg ctor from T16 emits cap_exceeded
under AuditCategory.LICENSE).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cameleer-server-core/src/main/java/com/cameleer/server/core/security/UserRepository.java

@@ -32,4 +32,7 @@ public interface UserRepository {
 
     /** Mark all tokens issued before {@code timestamp} as revoked for the given user. */
     void revokeTokensBefore(String userId, Instant timestamp);
+
+    /** Total user count, used for {@code max_users} license cap enforcement. */
+    long count();
 }