Permanently delete never-paid VMs + super-admin VM purge

[v0l]

Fixes #168

Summary

VMs that have never been paid (their subscription was never set up) are now hard-deleted from the database instead of soft-deleted, both when an admin deletes them and in the worker's hourly unpaid-VM cleanup. Nothing is left behind.

Additionally, super_admins can permanently purge any VM (including ones with payment history) via a new purge flag on the delete endpoint — intended for clearing out test VMs.

Changes

• LNVpsDb::hard_delete_vm(vm_id) (mysql + mock) — removes the VM row plus every related record in one transaction: vm_history, vm_firewall_rule, vm_ip_assignment, and the VM's own subscription (+ cascaded subscription_line_item) and its subscription_payment history (payments deleted first, since they lack ON DELETE CASCADE).
• WorkJob::DeleteVm gains a purge flag. The worker computes hard_delete = purge || !ever_paid and skips vm_history logging on hard delete (the row is gone → would break the FK).
• provisioner.delete_vm(vm_id, purge) picks hard vs soft delete.
• DELETE /api/admin/v1/vms/{id} accepts optional purge: true, gated to the super_admin role via new AdminAuth::is_super_admin (checked before the VM lookup, so non-super-admins get 403).
• Worker unpaid-cleanup now purges never-paid VMs.

Tests

• test_hard_delete_vm_purges_related_records (mock DB) — full cleanup
• test_delete_vm_purge_removes_vm_row (provisioner) — purge removes VM row & hard-deletes IPs
• Updated two worker unpaid-cleanup tests to assert the row is purged
• test_vm_manager_cannot_purge_vm (e2e RBAC) — non-super-admin purge → 403, plus new delete_auth_body client helper

Docs

• API_CHANGELOG.md and ADMIN_API_ENDPOINTS.md updated for the purge flag / new behaviour

All builds pass (cargo build --workspace), formatting is clean, and unit tests pass for lnvps_db, lnvps_api, lnvps_api_admin, and lnvps_api_common. The mysql hard_delete_vm and admin endpoint are additionally covered by the e2e suite.