Resolve session access_key from owner main_access_key instead of sessions.access_key column

Part of BA-5609. Depends on BA-5650. Second of 3 sub-PRs splitting the session owner_id migration.

## Objective

Reroute every reader of SessionRow.access_key / KernelRow.access_key to the owner main_access_key via UserRow join. External wire schemas (GraphQL ComputeSession.access_key, REST response keys, agent env vars, event payload keys) are preserved; only the value source changes. The DB columns still exist after this PR; dropping them lands in the final sub-PR.

## Scope

- api/adapters/session.py: inject UserRepository, add _resolve_main_access_key_map, instance-method _session_data_to_node / _kernel_info_to_node.
- api/gql_legacy/session.py, kernel.py, scaling_group.py: rewire ComputeSession.access_key / ComputeSessionNode.access_key / LegacyComputeSession filters through UserRow.main_access_key.
- api/rest/compute_sessions/adapter.py: introduce by_main_access_key_\* QueryCondition helpers in models/session/conditions.py for the REST string-filter path.
- events/hub/propagators/session.py: add kernels/sessions -> users join; source access_key payload value from users.main_access_key (wire key preserved).
- registry.py: resolve main_access_key before PRE_/POST_DESTROY_SESSION hook tuples and decrement-concurrency sites.
- repositories/scheduler/db_source/db_source.py, repositories/resource_preset/db_source/types.py, repositories/group/user db_sources, repositories/export/reports/{session,keypair}.py: add UserRow joins, use main_access_key.
- Add SchedulerRepository.resolve_main_access_keys(session_ids) batch helper; use it from sokovan lifecycle handlers and coordinator promotion path.
- Drop access_key field from SessionData / SessionMetadata / UserPermission data types (kept on sokovan dataclasses as resolved main_access_key per producer contract).
- Update unit tests: fixtures must provide main_access_key on the owner UserRow for GraphQL/REST assertions to pass.

## Acceptance Criteria

- pants fmt / fix / lint / check clean.
- GraphQL / REST response shapes unchanged; values sourced from main_access_key.
- Event propagator payloads unchanged; agent-facing contracts preserved.
- sessions.access_key and kernels.access_key DB columns still exist (not read anywhere).
- Unit tests pass.

JIRA Issue: BA-5651