LIR: ASN sponsoring provisioner, aut-num object & admin assignment flow

[v0l]

Part of the LIR sponsoring epic (see #39).

The asn_subscription DB layer exists (table + model AsnSubscription/AsnSubscriptionStatus + traits + mysql + mock + resource resolution). This issue covers turning it into a fulfillable product.

Unlike IP ranges, an ASN is a unique registry resource assigned by the RIR (async, admin-in-the-loop) — nothing is allocated locally.

Scope

• AsnProvisioner + thin AsnLineItemHandler (mirror the IpRangeProvisioner / IpRangeLineItemHandler split).
• on_payment (gated — see below): create a Requested asn_subscription row + notify admins to file the RIR sponsorship request.
• Admin action to record the RIR-assigned AS number → set asn, status = Assigned, assigned_at; then create the aut-num whois object.
• Extend RegistryProvider with create_aut_num / delete_aut_num (RIPE whois aut-num), storing aut_num_ref. (No RPKI for the ASN itself; ASPA is not standard yet.)
• Expiry teardown: withdraw the aut-num, deactivate the row.
• ASN pricing + replace the not_implemented branch in POST /api/v1/subscriptions (AsnSponsoring line item); admin/user endpoints to view status.

Fulfilment gate (compliance)

• Refuse to file the RIR request / create the aut-num until KYC verified (LIR: End-User KYC via Stripe Identity #188) AND a fully-signed LIR agreement exists (LIR: persist & bilaterally sign the Sponsoring LIR Agreement #189). RIPE requires the contract in place at assignment.

Depends on: #188, #189. Related: registry provider config (#191).