refactor(kol-admin): move subscription admin endpoints from tenant-api to ops-api

Approving / manually binding / revoking KOL subscriptions belonged to the
operations console, not the tenant-admin role on tenant-api. Add a fresh
KolSubscriptionService + repository + handlers under the ops module with
its own list/manual-bind/approve/revoke routes, wire a Redis-backed cache
into ops-api so admin actions can invalidate tenant prompt caches, and
delete the tenant-side admin service/handler now that ops-web owns the UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/configs/ops-config.yaml

@@ -22,6 +22,13 @@ monitoring_database:
   max_open_conns: 10
   max_idle_conns: 2
 
+redis:
+  addr: localhost:6379
+  db: 0
+
+cache:
+  driver: redis
+
 log:
   level: info
   format: json