Purging an app config definition leaves the RBAC nodes of its cascaded allow-list entries and fragments

AppConfigDefinitionPurger deletes the definition row, and the database cascades the delete to app_config_allow_list and app_config_fragments through their config_name foreign keys (ON DELETE CASCADE). The generic purge path (V2WriteOps.purge_entity → _teardown) removes only the purged entity's own virtual entity and labels. The cascaded allow-list entries and fragments lose their rows but keep their virtual_entities rows and everything hanging off them by foreign key, so the RBAC graph accumulates nodes for entities that no longer exist.

## Expected

- Purging a definition removes the virtual entity of every allow-list entry and fragment the delete cascades to.

## Candidate approaches

- The definition purge composes the dependent batch purges (an EntityBatchPurger selecting fragments and allow-list entries by config_name) and then the definition purge inside one write_ops() transaction, the way ProjectRepository.purge_group does for endpoints and sessions.
- A purger-level hook naming the entities a delete cascades to, so the generic _teardown covers them for every entity with database cascades.

Decided: the first approach, inside the app config package (PR #14610). The allow-list purge keeps the generic path and the same gap for the fragments it cascades to.

## Acceptance

- After purging a definition that has an allow-list entry and a fragment, no virtual_entities row remains for either.
- A test seeds the three rows and their nodes directly and checks the graph after the purge.

## Related

Found while writing the app_config_definition scenarios (BA-7832, PR #14511); its KNOWLEDGE.md records the leftover nodes as a limitation.

JIRA Issue: BA-7879

Start in the app config package with AppConfigDefinitionPurger, EntityBatchPurger, and the V2WriteOps.purge_entity → _teardown path. Review the app_config_definition scenarios and the related KNOWLEDGE.md limitation, then inspect PR #14610 for the decided composition approach. Done means the seeded definition, allow-list entry, fragment, and their virtual_entities rows are removed after the purge.

Written by the indexing model from the issue text.