Adds LicenseEnforcer.assertWithinCap call at the top of create() using repo.listByTenant(tenantId).size() as the current count. Lifts the cap in OutboundConnectionAdminControllerIT (duplicateNameReturns409 needs 2 creates in one test). LicenseExceptionAdvice maps the rejection to the standard 403 envelope; cap_exceeded audit row emitted via the LicenseEnforcer 3-arg ctor. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>