refactor(kol-admin): move subscription admin endpoints from tenant-api to ops-api

Approving / manually binding / revoking KOL subscriptions belonged to the
operations console, not the tenant-admin role on tenant-api. Add a fresh
KolSubscriptionService + repository + handlers under the ops module with
its own list/manual-bind/approve/revoke routes, wire a Redis-backed cache
into ops-api so admin actions can invalidate tenant prompt caches, and
delete the tenant-side admin service/handler now that ops-web owns the UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/ops-api/main.go

@@ -16,8 +16,10 @@ import (
 	opsconfig "github.com/geo-platform/tenant-api/internal/ops/config"
 	"github.com/geo-platform/tenant-api/internal/ops/repository"
 	"github.com/geo-platform/tenant-api/internal/ops/transport"
+	"github.com/geo-platform/tenant-api/internal/shared/cache"
 	"github.com/geo-platform/tenant-api/internal/shared/observability"
 	"github.com/geo-platform/tenant-api/internal/shared/repository/postgres"
+	"github.com/geo-platform/tenant-api/internal/shared/repository/redis"
 )
 
 func main() {
@@ -50,8 +52,16 @@ func main() {
 	}
 	defer monitoringPool.Close()
 
+	rdb, err := redis.NewClient(ctx, cfg.Redis)
+	if err != nil {
+		logger.Sugar().Fatalf("ops-api init redis: %v", err)
+	}
+	defer func() { _ = rdb.Close() }()
+	appCache := cache.New(cfg.Cache.Driver, rdb)
+
 	accountsRepo := repository.NewAccountRepository(pool)
 	adminUsersRepo := repository.NewAdminUserRepository(pool)
+	kolSubscriptionsRepo := repository.NewKolSubscriptionRepository(pool)
 	auditsRepo := repository.NewAuditRepository(pool)
 	siteDomainMappingsRepo := repository.NewSiteDomainMappingRepository(monitoringPool)
 
@@ -66,6 +76,7 @@ func main() {
 	authSvc := app.NewAuthService(accountsRepo, auditSvc, issuer)
 	accountSvc := app.NewAccountService(accountsRepo, auditSvc)
 	adminUserSvc := app.NewAdminUserService(adminUsersRepo, auditSvc, cfg.AdminUsers.DefaultPlanCode)
+	kolSubscriptionSvc := app.NewKolSubscriptionService(kolSubscriptionsRepo, auditSvc).WithCache(appCache)
 	siteDomainMappingSvc := app.NewSiteDomainMappingService(siteDomainMappingsRepo, auditSvc)
 
 	if err := app.SeedDefaultAdmin(ctx, accountsRepo, app.DefaultAdminSeed{
@@ -91,6 +102,7 @@ func main() {
 		Auth:         authSvc,
 		Accounts:     accountSvc,
 		AdminUsers:   adminUserSvc,
+		KolSubs:      kolSubscriptionSvc,
 		Audits:       auditSvc,
 		SiteDomains:  siteDomainMappingSvc,
 	})