feat: refine api key permissions and admin routes

apps/api/internal/store/identity_admin.go

@@ -258,14 +258,25 @@ RETURNING `+userGroupColumns,
 }
 
 func (s *Store) DeleteUserGroup(ctx context.Context, id string) error {
-	result, err := s.pool.Exec(ctx, `DELETE FROM gateway_user_groups WHERE id = $1::uuid`, id)
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+
+	if _, err := tx.Exec(ctx, `
+DELETE FROM gateway_access_rules
+WHERE subject_type = 'user_group' AND subject_id = $1::uuid`, id); err != nil {
+		return err
+	}
+	result, err := tx.Exec(ctx, `DELETE FROM gateway_user_groups WHERE id = $1::uuid`, id)
 	if err != nil {
 		return err
 	}
 	if result.RowsAffected() == 0 {
 		return pgx.ErrNoRows
 	}
-	return nil
+	return tx.Commit(ctx)
 }
 
 const tenantColumns = `