Define shared GraphQL field/resolver pattern for per-node RBAC permissions

## Goal

Define a reusable GraphQL field + resolver pattern (helper, mixin, or decorator) that any RBAC-managed entity node type can adopt to expose the current user's effective operations on that specific entity instance. The pattern MUST consume the effective-permissions DataLoader (sibling sub-issue) so list views resolve in a single batched call per page.

## Scope

1. Decide field name (open question on parent epic — `permissions` vs `effective_permissions` vs `allowed_operations`). Pick one that does not collide with the legacy `vfolder_node.permissions` field.

2. Implement the shared pattern. Likely shape: a helper `resolve_effective_permissions(self, info)` that:

- Reads `user_id` from `info.context`

- Determines the entity's `RBACElementType` (statically per node type)

- Calls `info.context.data_loaders.effective_permissions_loader.load((user_id, element_type, entity_id))`

- Returns `set[OperationType]` (typed enum collection, not strings)

3. Apply the pattern to one pilot node (suggest `vfolder_node` since it already has the legacy field to compare against) to validate the design before rolling out to other nodes (those rollouts get their own sub-issues).

4. Component tests covering: superadmin bypass, project-admin scope, regular user, unauthorized user (empty set), and batched resolution in a `\*_nodes` connection query (asserting a single repository call per page).

## Non-Goals

- Rolling out to every entity node — each node gets its own follow-up sub-issue under BA-5839.

- Deprecating the legacy `vfolder_node.permissions` field — separate sub-issue, coordinated with WebUI.

## Dependencies

- Sibling sub-issue: effective-permissions DataLoader

## References

- Existing per-node resolver pattern example: `src/ai/backend/manager/api/gql/permission.py:116` (`RoleGQL.role` via `role_loader.load`)

- Parent epic: BA-5839

JIRA Issue: BA-5841