fix(kol): Phase 1 review — ACL lineage, expiry filters, tighter tenant scope

Addresses findings from consolidated Phase 1 code review:

- Add composite unique indexes + composite FKs so subscription_prompts and
  packages cannot reference mismatched (tenant_id, package_id, prompt_id)
  tuples, enforcing ACL lineage at the schema level.
- Add status CHECK constraints on all KOL tables as defense-in-depth.
- ListActiveSubscribersForPackage: drop meaningless tenant_id IS NOT NULL,
  add end_at expiry filter so fan-out skips expired subscribers.
- ApproveKolSubscription: add status='pending' guard to prevent double-approval.
- ListSubscriptionPromptsByTenant: join subscription/prompt/package/profile
  lifecycle so hidden/archived content no longer leaks; surface
  kol_display_name for UI.
- ListPublishedKolPackages: exclude expired subscribers from marketplace count.
- KolDashboardTrend: rewrite as CTE with day-series, returning both daily
  usage and new subscription counts.
- Remove cosmetic tenant_id IS NOT NULL from dashboard overview queries
  (the column is NOT NULL by schema).
- check_tenant_scope.sh: require tenant_id = sqlc.(n?)arg filter, reject
  tenant_id IS NOT NULL as a fake scope, maintain explicit exemption list.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/repository/kol_usage_repo.go

@@ -46,8 +46,9 @@ type KolDashboardOverview struct {
 }
 
 type KolDashboardTrendPoint struct {
-	Day    time.Time
-	Usages int64
+	Day           time.Time
+	Usages        int64
+	Subscriptions int64
 }
 
 type KolUsagePackageStats struct {
@@ -170,8 +171,9 @@ func (r *kolUsageRepository) DashboardTrend(ctx context.Context, packageIDs []in
 			day = row.D.Time
 		}
 		result[i] = KolDashboardTrendPoint{
-			Day:    day,
-			Usages: row.Usages,
+			Day:           day,
+			Usages:        row.Usages,
+			Subscriptions: row.Subscriptions,
 		}
 	}
 	return result, nil