Add server side validation for new site and server

Unpaid teams were prevented from creating sites and servers only on the client; server-side enforcement now blocks unauthorized creation.