feat(tenant/kol): let KOLs self-subscribe to their own published packages

Add /kol/manage/packages/:id/self-subscription POST/DELETE on the tenant
side so a KOL can grant themselves access to their own published package
without going through the marketplace approval flow. Reject self-subscribe
through the marketplace with a clear error, expose owned_by_current_tenant
on package responses, and surface a self_subscription block on KolPackage
Response. The admin-web KOL workspace gets 订阅自己 / 取消订阅 entries with
matching messaging in the marketplace detail view.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/router.go

@@ -108,6 +108,8 @@ func RegisterRoutes(app *bootstrap.App) {
 	kolManage.DELETE("/packages/:id", kolManageHandler.DeletePackage)
 	kolManage.PUT("/packages/:id/publish", kolManageHandler.PublishPackage)
 	kolManage.PUT("/packages/:id/archive", kolManageHandler.ArchivePackage)
+	kolManage.POST("/packages/:id/self-subscription", kolManageHandler.SelfSubscribePackage)
+	kolManage.DELETE("/packages/:id/self-subscription", kolManageHandler.CancelSelfSubscription)
 	kolManage.GET("/packages/:id/prompts", kolManageHandler.ListPrompts)
 	kolManage.POST("/packages/:id/prompts", kolManageHandler.CreatePrompt)
 	kolManage.GET("/prompts/:id", kolManageHandler.GetPromptLatest)
@@ -139,14 +141,6 @@ func RegisterRoutes(app *bootstrap.App) {
 	kolSubscriptions.GET("/subscription-prompts/:id/schema", kolMarketplaceHandler.SubscriptionPromptSchema)
 	kolSubscriptions.POST("/subscription-prompts/:id/generate", kolMarketplaceHandler.Generate)
 
-	// V1 compromise: these admin operations live on tenant-api and are gated by
-	// tenant_role=tenant_admin until the platform-api/module is built.
-	kolAdmin := tenantProtected.Group("/kol/admin")
-	kolAdminHandler := NewKolAdminHandler(app)
-	kolAdmin.PUT("/subscriptions/:id/approve", kolAdminHandler.ApproveSubscription)
-	kolAdmin.POST("/subscriptions", kolAdminHandler.ManualBind)
-	kolAdmin.PUT("/subscriptions/:id/revoke", kolAdminHandler.RevokeSubscription)
-
 	articles := tenantProtected.Group("/articles")
 	artHandler := NewArticleHandler(app)
 	articles.GET("", artHandler.List)