fix: purge auth_providers when reaping an instance

auth_providers was missing from ScopedCollections, so reap.go's
scopedCollectionsForPurge() (derived from that list) never deleted an
instance's providers, leaving orphaned rows holding encrypted client
secrets forever. Verified migration 0004's $rename over org_id->instance_id
is a no-op here since auth_providers never carried org_id.

server/internal/services/migrate_instance.go

@@ -39,6 +39,7 @@ var ScopedCollections = []string{
 	"notification_channels",
 	"console_sessions",
 	"audit_logs",
+	"auth_providers",
 }
 
 // collectionRenames maps the two collections whose names change. Ordered so the