refactor(kol-admin): move subscription admin endpoints from tenant-api to ops-api

Approving / manually binding / revoking KOL subscriptions belonged to the
operations console, not the tenant-admin role on tenant-api. Add a fresh
KolSubscriptionService + repository + handlers under the ops module with
its own list/manual-bind/approve/revoke routes, wire a Redis-backed cache
into ops-api so admin actions can invalidate tenant prompt caches, and
delete the tenant-side admin service/handler now that ops-web owns the UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/transport/router.go

@@ -19,6 +19,7 @@ type Deps struct {
 	Auth         *app.AuthService
 	Accounts     *app.AccountService
 	AdminUsers   *app.AdminUserService
+	KolSubs      *app.KolSubscriptionService
 	Audits       *app.AuditService
 	SiteDomains  *app.SiteDomainMappingService
 }
@@ -81,6 +82,12 @@ func RegisterRoutes(d Deps) {
 		authed.POST("/admin-users/:id/status", setAdminUserStatusHandler(d.AdminUsers))
 		authed.POST("/admin-users/:id/password", resetAdminUserPasswordHandler(d.AdminUsers))
 
+		authed.GET("/kol/packages", listKolSubscriptionPackagesHandler(d.KolSubs))
+		authed.GET("/kol/subscriptions", listKolSubscriptionsHandler(d.KolSubs))
+		authed.POST("/kol/subscriptions/manual-bind", manualBindKolSubscriptionHandler(d.KolSubs))
+		authed.POST("/kol/subscriptions/:id/approve", approveKolSubscriptionHandler(d.KolSubs))
+		authed.POST("/kol/subscriptions/:id/revoke", revokeKolSubscriptionHandler(d.KolSubs))
+
 		authed.GET("/audits", listAuditsHandler(d.Audits))
 
 		authed.GET("/site-domain-mappings", listSiteDomainMappingsHandler(d.SiteDomains))