refactor(backend): extract punishment *Api interfaces, fix template-delete FK bug

[TheMeinerLP]

Summary

Four items from specs/002-punishment-core/tasks.md's Polish phase:

• T027: Extracts PunishmentApi and PunishmentTemplateApi (routing + @Operation/@ApiResponse), both controllers now implement their interface per micronaut-openapi-contract, following the existing PlayerLookupApi precedent in this codebase.
• T025: Documents PunishmentApplicationService.apply/revoke's read-modify-write race window in a class Javadoc, matching EloService's documented-limitation style.
• T029 — a real correctness bug, not just layering: DELETE /template/delete/{id} previously let an unhandled DB foreign-key exception surface as a raw 500 whenever a punishment still referenced the template — contradicting spec US5 Acceptance Scenario 3 and FR-010's "let network operators... remove" a template. PunishmentTemplateService.remove() now checks PunishmentRepository.existsByTemplate_Identifier first and returns a clean 409 Conflict instead.
• T031: Documents RedisTopology's hardcoded key/channel constants as intentional — it's a wire protocol shared with every Velocity proxy, not a per-side tunable, so making it independently env-var configurable on each side risks silent drift/mismatch between backend and proxy.

Deliberately not included: T026 (DTO/Error-variant consolidation) and T028 (snapshotting a template's reason onto PunishmentEntity, which needs a new Liquibase changeset) — both real, higher-risk changes (breaking wire format / a schema migration) that need their own explicit scoping decision.

Test plan

• ./gradlew :backend:compileJava succeeds
• Generated OpenAPI spec still documents all moved endpoints correctly
• Verified against real Docker infra: template create/update/get/getAll, punishment apply/revoke/getAll all unaffected; specifically confirmed the T029 fix — created a template, applied a punishment from it, then confirmed DELETE /template/delete/{id} now returns 409 instead of an unhandled 500; confirmed deleting an unused template still returns 200, and a nonexistent template still returns 404