feat(login-guard): unlock entire scope and report deleted keys

Admin login-lock reset now SCANs and clears all auth:login:* keys (any
scope) and surfaces redis_deleted_keys / fallback_deleted_keys back to
ops-web so the operator can tell whether the cache was actually hit.
Also tracks paired keys via a per-identifier index plus an unlock marker
so legacy/in-flight pair locks get cleared on the next acquire.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/transport/admin_user_handler.go

@@ -292,10 +292,11 @@ func resetAdminUserLoginLockHandler(svc *app.AdminUserService) gin.HandlerFunc {
 			response.Error(c, err)
 			return
 		}
-		if err := svc.ResetLoginLock(c.Request.Context(), actorFromGin(c), id); err != nil {
+		result, err := svc.ResetLoginLock(c.Request.Context(), actorFromGin(c), id)
+		if err != nil {
 			response.Error(c, err)
 			return
 		}
-		response.Success(c, gin.H{"id": id})
+		response.Success(c, result)
 	}
 }