fix(auth): delete the Kratos identity on account deletion

Account deletion removed all local data but left the Ory Kratos
identity intact — an orphaned identity that can still authenticate.
Close the gap:

- kratos.Client gains the admin API: NewClient(publicURL, adminURL)
  and DeleteIdentity (DELETE /admin/identities/{id}; a 404 is treated
  as success so a retry after a partial failure is idempotent).
- AuthService.DeleteAccount deletes the Kratos identity FIRST; if that
  call fails it aborts before touching local data, so the operation is
  retryable rather than partially applied.
- KRATOS_ADMIN_URL config (default http://kratos:4434) + router wiring.
- kratos NetworkPolicy split: the api pods may now reach the admin API
  :4434 (Traefik still reaches only the public API :4433).
- kratos CORS: allow_credentials + OPTIONS so the web browser flows
  (ory_kratos_session cookie) work; origins stay an explicit allowlist.
- Regression tests: identity teardown happens, and a Kratos failure
  aborts the deletion instead of orphaning local data.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/router/router.go

@@ -246,8 +246,9 @@ func SetupRouter(deps *Dependencies) *echo.Echo {
 	subscriptionWebhookHandler.SetCacheService(deps.Cache)
 
 	// Initialize Kratos auth middleware (replaces hand-rolled token auth).
-	kratosClient := kratos.NewClient(cfg.Security.KratosPublicURL)
+	kratosClient := kratos.NewClient(cfg.Security.KratosPublicURL, cfg.Security.KratosAdminURL)
 	authMiddleware := custommiddleware.NewKratosAuth(kratosClient, deps.Cache, deps.DB)
+	authService.SetKratosClient(kratosClient) // account deletion removes the Kratos identity
 
 	// Initialize audit service for security event logging
 	auditService := services.NewAuditService(deps.DB)