enforce License.IsSeatCountEnforced if set (#31354)

* enforce License.IsSeatCountEnforced if set

If a license sets `IsSeatCountEnforced`, enforce the user limit therein
as a hard cap.

Fixes: https://mattermost.atlassian.net/browse/CLD-9260

* remove duplicate tests

* Improve user limit error messages and display

- Add separate error messages for licensed vs unlicensed servers
- Licensed servers: "Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMITS"
- Unlicensed servers: "Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED"
- Remove redundant "Contact administrator" text from activation errors shown to admins
- Fix system console to display actual server error messages instead of generic "Failed to activate user"

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add license nil check and test coverage

- Add license != nil check in GetServerLimits to prevent panic
- Add test case to verify graceful handling of license being set to nil
- Ensures fallback to hard-coded limits when license becomes nil

Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>

* Fix user limits tests to expect license-specific error IDs

Update test expectations to use the new license-specific error IDs:
- app.user.update_active.license_user_limit.exceeded for licensed server user activation
- api.user.create_user.license_user_limits.exceeded for licensed server user creation

Also update frontend to show actual server error messages instead of generic ones in system console.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Remove redundant license nil test

The test couldn't meaningfully verify nil license behavior since it relied on
hard-coded constants that can't be modified in the test.

Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>

* Fix whitespace issue in limits_test.go

Remove unnecessary trailing newline to pass style checks.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* updated i18n

* s/ERROR_LICENSED_USERS_LIMITS/ERROR_LICENSED_USERS_LIMIT_EXCEEDED/, expand warning log

* Add 5% grace period for licensed user limits

- Add calculateGraceLimit() function with 5% or +1 minimum grace
- Apply grace period only to licensed servers with seat count enforcement
- Handle zero user licenses by returning zero grace limit
- Add comprehensive test coverage for grace period scenarios
- Unlicensed servers maintain existing hard-coded limits without grace

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix TestCreateUserOrGuestSeatCountEnforcement to account for 5% grace period

The test was failing because it expected user creation to fail at exactly
the license limit, but the implementation now includes a 5% grace period
before enforcement kicks in.

Changes:
- Update test cases to create users up to the grace limit (6 for a 5-user license)
- Add comments explaining the grace period calculation
- Both regular user and guest user creation tests now properly validate
  enforcement at the grace limit rather than the base license limit

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix TestUpdateActiveWithUserLimits to account for 5% grace period

Update test expectations to match the new grace period behavior:
- At base limit (100) but below grace limit (105): should succeed
- At grace limit (105): should fail
- Above grace limit (106): should fail

This aligns the tests with the license enforcement implementation
that includes a 5% grace period above the licensed user count.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>
Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/app/limits.go

@@ -6,8 +6,6 @@ package app
 import (
 	"net/http"
 
-	"github.com/mattermost/mattermost/server/public/shared/mlog"
-
 	"github.com/mattermost/mattermost/server/public/model"
 )
 
@@ -16,37 +14,54 @@ const (
 	maxUsersHardLimit = 5_000
 )
 
+// calculateGraceLimit calculates a grace limit that is 5% above the base limit
+// or at least 1 user above the base limit, whichever is higher.
+// Special case: if baseLimit is 0, returns 0.
+func calculateGraceLimit(baseLimit int64) int64 {
+	if baseLimit == 0 {
+		return 0
+	}
+	graceFromPercentage := int64(float64(baseLimit) * 1.05)
+	graceFromFloor := baseLimit + 1
+	if graceFromPercentage > graceFromFloor {
+		return graceFromPercentage
+	}
+	return graceFromFloor
+}
+
 func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) {
-	var limits = &model.ServerLimits{}
+	limits := &model.ServerLimits{}
+	license := a.License()
 
-	if a.shouldShowUserLimits() {
-		activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{})
-		if appErr != nil {
-			mlog.Error("Failed to get active user count from database", mlog.String("error", appErr.Error()))
-			return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr)
-		}
-
-		limits.ActiveUserCount = activeUserCount
+	if license == nil && maxUsersLimit > 0 {
+		// Enforce hard-coded limits for unlicensed servers (no grace period).
 		limits.MaxUsersLimit = maxUsersLimit
 		limits.MaxUsersHardLimit = maxUsersHardLimit
+	} else if license != nil && license.IsSeatCountEnforced && license.Features != nil && license.Features.Users != nil {
+		// Enforce license limits as required by the license with grace period.
+		licenseUserLimit := int64(*license.Features.Users)
+		limits.MaxUsersLimit = licenseUserLimit
+		limits.MaxUsersHardLimit = calculateGraceLimit(licenseUserLimit)
 	}
 
+	activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{})
+	if appErr != nil {
+		return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr)
+	}
+	limits.ActiveUserCount = activeUserCount
+
 	return limits, nil
 }
 
-func (a *App) shouldShowUserLimits() bool {
-	if maxUsersLimit == 0 {
-		return false
-	}
-
-	return a.License() == nil
-}
-
-func (a *App) isHardUserLimitExceeded() (bool, *model.AppError) {
+func (a *App) isAtUserLimit() (bool, *model.AppError) {
 	userLimits, appErr := a.GetServerLimits()
 	if appErr != nil {
 		return false, appErr
 	}
 
-	return userLimits.ActiveUserCount > userLimits.MaxUsersHardLimit, appErr
+	if userLimits.MaxUsersHardLimit == 0 {
+		return false, nil
+	}
+
+	return userLimits.ActiveUserCount >= userLimits.MaxUsersHardLimit, appErr
 }