Migrate domain's allowed container registry from name ARRAY to RBAC ASE

## Background

The `domains.allowed_docker_registries` column stores container registry names as a PostgreSQL ARRAY(String). Since multiple registries can share the same name, the name-based lookup affects every registry with that name — enabling or disabling one toggles all of them at once.

The project side has already migrated `association_container_registries_groups` to the RBAC table `association_scopes_entities` with `(scope=PROJECT, entity=CONTAINER_REGISTRY)` via alembic revision `2e42a745f939`. Only the domain side remains on the legacy name ARRAY.

## Goal

Migrate the domain ↔ container registry relation to the RBAC ASE table as well. Use ASE as the single source of truth — no new junction table. To keep the transition safe, the implementation maintains a dual-write to both ASE and the existing ARRAY column for the duration of the migration.

## Scope

- Alembic migration that backfills ARRAY data into ASE rows `(scope=DOMAIN, entity=CONTAINER_REGISTRY)`.
- New `ContainerRegistryDomainEntityUnbinder` plus binder helpers built on `RBACScopeBinder` / `RBACScopeEntityUnbinder`.
- Domain create/update write path performs dual-write: ASE row sync plus ARRAY column update.
- Switch five read sites (image filter ×2, gql_legacy image filter, registry permission ×2, scheduler) to ASE JOIN to fix the same-name correctness bug.
- v2 stack: change the existing `allowed_docker_registries` field type from `list[str]` (names) to `list[UUID]` (ids) across DTO / GQL v2 / adapter / internal Data type.
- gql_legacy stays on name-based graphene schema; resolvers source the name list from ASE+container_registries JOIN to avoid stale reads.

## Non-goals

- Dropping the `allowed_docker_registries` ARRAY column (deferred to a later major release).
- Creating a dedicated domain↔registry junction table.
- Changing the gql_legacy graphene schema for this field.
- WebUI work (handled separately, outside this epic).

JIRA Issue: BA-5785