[Domain] Migrate RBAC entity association to `domain_id`

## Goal

Switch the current RBAC pattern (RBACEntityCreator / RBACEntityPurger / RBACElementRef and the association_scopes_entities table) to identify Domains by `id` instead of `name`. Migrate existing rows accordingly.

## Scope

- Alembic data migration: backfill `association_scopes_entities.scope_id` from `domains.name` to `domains.id::text` where `scope_type = 'domain'`. Provide downgrade.
- Update every call site that constructs `RBACElementRef(RBACElementType.DOMAIN, element_id=...)` so it passes `domain.id` (or `DomainID`) instead of `domain.name`.
- Update `RBACEntityCreator` / `RBACEntityPurger` usage in Domain create / purge paths so the registered `entity_id` / scope reference uses the new `domain_id`.
- Update repositories / services that build `RBACElementRef` for Domain on create, delete, role-grant, role-revoke, and permission lookup paths.
- Tests: update RBAC entity-association tests to expect id-based `scope_id`.

## Explicitly out of scope (legacy RBAC, do NOT touch)

- `DomainScope` dataclass
- `scope_binder` and any \*_scope_binder helpers
- `DomainPermissionContext`, `DomainPermissionContextBuilder`
- legacy `models/rbac/__init__.py` scope types

## Depends on

BA-6044 (id column must exist). Recommended order: after BA-6046 so the FK schema is already id-based when RBAC mapping is migrated, avoiding inconsistency between the two layers.

JIRA Issue: BA-6047