feat(admin-users): add plan entitlement revocation flow

apps/aether-gateway/src/control/route/admin/operations_families.rs

@@ -797,6 +797,18 @@ pub(super) fn classify_admin_operations_family_route(
             "admin:users",
             false,
         ))
+    } else if method == http::Method::DELETE
+        && normalized_path_no_trailing.starts_with("/api/admin/users/")
+        && normalized_path_no_trailing.contains("/billing/entitlements/")
+        && normalized_path_no_trailing.matches('/').count() == 7
+    {
+        Some(classified(
+            "admin_proxy",
+            "users_manage",
+            "revoke_user_billing_entitlement",
+            "admin:users",
+            false,
+        ))
     } else if method == http::Method::GET
         && normalized_path.starts_with("/api/admin/users/")
         && normalized_path.ends_with("/sessions")

apps/aether-gateway/src/control/tests/admin_users.rs

@@ -103,6 +103,22 @@ fn classifies_admin_user_billing_routes_as_admin_proxy_route() {
         Some("admin:users")
     );
 
+    let revoke_uri: Uri = "/api/admin/users/user-1/billing/entitlements/entitlement-1"
+        .parse()
+        .expect("uri should parse");
+    let revoke = classify_control_route(&http::Method::DELETE, &revoke_uri, &headers)
+        .expect("route should classify");
+    assert_eq!(revoke.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(revoke.route_family.as_deref(), Some("users_manage"));
+    assert_eq!(
+        revoke.route_kind.as_deref(),
+        Some("revoke_user_billing_entitlement")
+    );
+    assert_eq!(
+        revoke.auth_endpoint_signature.as_deref(),
+        Some("admin:users")
+    );
+
     let context = GatewayPublicRequestContext::from_request_parts(
         "trace-user-billing-grant",
         &http::Method::POST,