fix(vpn): commit before sync_wireguard_config to ensure data visibility

sync_wireguard_config opens its own AdminAsyncSessionLocal connection
which cannot see uncommitted data from the caller's transaction. Add
_commit_and_sync helper that commits first, then regenerates wg0.conf.

Also removes the unused db parameter from sync_wireguard_config.

backend/app/routers/tenants.py

@@ -232,13 +232,11 @@ async def delete_tenant(
     had_vpn = await get_vpn_config(db, tenant_id)
 
     await db.delete(tenant)
-    await db.flush()
+    await db.commit()
 
     # Regenerate wg0.conf without deleted tenant's peers
     if had_vpn:
-        await sync_wireguard_config(db)
-
-    await db.commit()
+        await sync_wireguard_config()
 
 
 # ---------------------------------------------------------------------------