Add the self-managed Orbit instance trial

What does this MR do and why?

Adds the Orbit instance billing account, so GitLab Self-Managed and GitLab Dedicated get the same access rules as GitLab.com, for the whole instance.

• Billing.account_for(group) now returns the InstanceAccount off GitLab.com. It shares the rules of Billing::Account with the GroupAccount from the previous MR, and keeps its facts (license, orbit_promo add-on, promo gate, trial flow, CustomersDot trial) private.
• Administrators start the instance trial with orbitInstanceStartTrial and read the state with orbit { access }. When the instance trial ends without the add-on, the end-of-trial cron turns Orbit off for every group.
• Admin area > Orbit opens without the orbit license, so it can show that Orbit is not available.

GitLab.com behavior does not change.

Closes https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1385

flowchart LR
  consumers["Policies, services,<br/>workers, GraphQL"] --> account["Billing::Account<br/>entitled? turn_on access<br/>start_trial end_trial_if_over"]
  account --> group["GroupAccount<br/>GitLab.com"]
  account --> instance["InstanceAccount<br/>Self-Managed, Dedicated"]

References

• Builds on !262136 (merged) (the Orbit billing account for top-level groups, merged)
• Replaces !261851 (closed) (closed)
• Epic: https://gitlab.com/groups/gitlab-org/-/epics/21198
• Next, the UI: https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1386

Database

When the instance trial ends during the beta, the end-of-trial cron deletes the enabled namespaces of groups with no beta enrollment, in batches of 1,000 by primary key. It runs only on GitLab Self-Managed and GitLab Dedicated, never on GitLab.com. orbit_namespace_enrollments.namespace_id is NOT NULL, so the NOT IN subquery cannot return a NULL.

SQL

DELETE FROM "knowledge_graph_enabled_namespaces"
WHERE "knowledge_graph_enabled_namespaces"."id" >= 1 AND "knowledge_graph_enabled_namespaces"."id" < 1001
AND "knowledge_graph_enabled_namespaces"."root_namespace_id" NOT IN (
  SELECT "orbit_namespace_enrollments"."namespace_id" FROM "orbit_namespace_enrollments"
  WHERE "orbit_namespace_enrollments"."source" = 1
)

Screenshots or screen recordings

No UI change.

How to set up and validate locally

1. On a self-managed GDK with an online cloud license and the Orbit license, end the beta for the instance:

   Feature.enable(:orbit_promo_access_gate)
   Feature.enable(:orbit_trial)

2. As an administrator, run this query in GraphiQL. Expect TRIAL_ELIGIBLE when CustomersDot offers the instance a trial:

   { orbit { access { state reason trial { state offer { durationDays initialCredits } } } } }

3. Start the trial. Expect TRIAL_ACTIVE:

   mutation { orbitInstanceStartTrial(input: {}) { access { state } errors } }

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.