feat(userLifecycle): plug actions to on_user_logout and on_user_deleted

- AuthzCacheLifecycleHook — invalidates the user_groups_cache Moka entry on logout/delete.
  - SessionRevocationLifecycleHook — explicit per-session firing of on_user_logout (currently per-call); session revocation inside the user-delete transaction.
  - DeletionMode-driven policy in HomeFolderLifecycleHook::on_user_deleted (trash vs hard-delete based on AdminDelete / GdprPurge).
  - Refactor delete_user_admin to expose a transaction handle so on_user_deleted can abort atomically.

src/infrastructure/repositories/pg/user_pg_repository.rs

@@ -27,6 +27,14 @@ impl UserPgRepository {
         Self { pool }
     }
 
+    /// Borrowed access to the connection pool. Exposed so callers can
+    /// open transactions that span this repo and other repos / hooks
+    /// (e.g. `AuthApplicationService::delete_user_admin` opening a tx
+    /// that wraps the lifecycle dispatcher + the DELETE).
+    pub fn pool(&self) -> &PgPool {
+        &self.pool
+    }
+
     // Helper method to map SQL errors to domain errors
     pub fn map_sqlx_error(err: sqlx::Error) -> UserRepositoryError {
         match err {