Migrate session lookup helpers (match_sessions/get_session) from access_key to user_uuid filtering

## Objective

Change the canonical owner filter on internal session lookup helpers from access_key to user_uuid. The REST API surface continues to accept owner_access_key; the service layer resolves it to user_uuid before calling the repository/helper layer. SessionRow.access_key column is preserved (still required by scheduler quota and downstream agent RPC); only the WHERE clause used for owner-scoped lookup changes.

## Motivation

An access_key always belongs to exactly one user, so filtering sessions by access_key is a strictly narrower view than filtering by user_uuid. Aligning lookup with user_uuid (a) lets a user with multiple keypairs see/manage all of their sessions uniformly via internal paths, and (b) brings session name uniqueness to the user level (consistent with the post-BA-3448 unique index).

## Scope

- models/session/row.py: change parameter access_key -> user_uuid on _build_session_fetch_query, _match_sessions_by_id, _match_sessions_by_name, SessionRow.match_sessions, SessionRow.get_session, SessionRow.list_sessions, SessionRow.get_session_by_id. WHERE clause becomes SessionRow.user_uuid == user_uuid.
- repositories/session/db_source/db_source.py: rename owner_access_key -> owner_user_uuid on get_session_validated, match_sessions, update_session_name (incl. duplicate-name check at lines 308-321), get_target_session_ids, _find_dependent_sessions, find_dependency_sessions, get_session_with_group, get_session_with_routing_minimal.
- repositories/session/repository.py, repositories/stream/db_source/db_source.py, repositories/events/db_source/db_source.py, repositories/session/dependency_graph.py: align signatures.
- Service layer: add a helper that resolves access_key -> user_uuid (or reuse existing query_userinfo result). Apply at all sites that currently pass access_key down. registry.create_session/create_cluster can use UserScope.user_uuid directly.
- API layer: keep owner_access_key as request parameter; the resolve happens in the service layer.
- Update affected unit/component tests.

## Out of Scope

- scheduler/predicates.py access_key filters (check_pending_session_count_limit, check_pending_session_resource_limit) — confirmed dead code in the sokovan path; left as-is.
- Sokovan validators in sokovan/scheduler/provisioner/validators/ — separate concern; quota enforcement remains keypair-scoped by design.
- Removing or renaming sessions.access_key / kernels.access_key columns (covered by BA-5653).
- GraphQL legacy access_key filter rewiring (BA-5651 territory).

## Behavioral Change

Session name lookup/duplicate detection becomes per-user instead of per-keypair. A user with multiple keypairs can no longer have two sessions with the same name across keypairs (consistent with the per-user unique index added in BA-3448).

## Acceptance Criteria

- pants fmt / fix / lint / check clean.
- No behavior change to REST v1/v2, GraphQL, agent RPC, or event payloads.
- sessions.access_key column remains in the schema and continues to be written on session creation.
- Unit / component tests pass.

## Notes

BA-5650 attempted a similar but broader migration (24 action dataclasses + scheduler/predicates + drf) and was closed as too large with breaking changes. This issue takes a narrower scope: only internal lookup helpers, with the API surface unchanged.

JIRA Issue: BA-6055