refactor(kol-admin): move subscription admin endpoints from tenant-api to ops-api

Approving / manually binding / revoking KOL subscriptions belonged to the
operations console, not the tenant-admin role on tenant-api. Add a fresh
KolSubscriptionService + repository + handlers under the ops module with
its own list/manual-bind/approve/revoke routes, wire a Redis-backed cache
into ops-api so admin actions can invalidate tenant prompt caches, and
delete the tenant-side admin service/handler now that ops-web owns the UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/config/config.go

@@ -15,6 +15,8 @@ type Config struct {
 	Server             sharedconfig.ServerConfig   `mapstructure:"server"`
 	Database           sharedconfig.DatabaseConfig `mapstructure:"database"`
 	MonitoringDatabase sharedconfig.DatabaseConfig `mapstructure:"monitoring_database"`
+	Redis              sharedconfig.RedisConfig    `mapstructure:"redis"`
+	Cache              sharedconfig.CacheConfig    `mapstructure:"cache"`
 	Log                sharedconfig.LogConfig      `mapstructure:"log"`
 	JWT                JWTConfig                   `mapstructure:"jwt"`
 	DefaultAdmin       DefaultAdminConfig          `mapstructure:"default_admin"`
@@ -53,6 +55,9 @@ func Load(path string) (*Config, error) {
 
 	v.SetDefault("server.port", 8090)
 	v.SetDefault("server.mode", "debug")
+	v.SetDefault("redis.addr", "localhost:6379")
+	v.SetDefault("redis.db", 0)
+	v.SetDefault("cache.driver", "redis")
 	v.SetDefault("log.level", "info")
 	v.SetDefault("log.format", "json")
 	v.SetDefault("jwt.access_ttl", 8*time.Hour)