[Domain] Drop legacy domain_name columns and migrate internal callers to domain_id

Goal

Finish the domain identifier migration that BA-6046 left partial: backfill any remaining NULL ``domain_id`` values, enforce ``NOT NULL`` on ``domain_id``, drop the legacy ``domain_name`` / ``domain`` string columns on the 10 referencing tables, and migrate every internal caller that still reads or filters by those columns to use ``domain_id`` instead.

Background

BA-6046 added ``domain_id`` UUID columns to the 10 referencing tables (users, groups, sessions, kernels, endpoints, endpoint_tokens, routings, model_cards, session_templates, sgroups_for_domains) and moved the FK constraint from ``domain_name`` → ``domains.name`` to ``domain_id`` → ``domains.id``. To minimize disruption it intentionally:

1. Left ``domain_id`` NULLABLE so existing INSERT paths that only populate the legacy string column keep working.

2. Retained the legacy ``domain_name`` / ``domain`` column (as a plain string, no FK) so the hundreds of call sites that read it or use it in search filters keep working.

With domain renames now possible (id is the stable PK), the legacy string columns can drift from ``domains.name`` and must be removed. The NULLABLE ``domain_id`` also has to become NOT NULL once all INSERT paths populate it.

Scope

1. Alembic: single revision that:

- Backfills remaining NULL ``domain_id`` values for all 10 tables (defensive: should be empty after BA-6046's backfill + new INSERT code below, but covers any rows inserted by legacy paths in the interim).

- Alters ``domain_id`` to NOT NULL on tables whose legacy column was NOT NULL (groups, sessions, kernels, endpoints, endpoint_tokens, routings, model_cards, session_templates, sgroups_for_domains).

- Drops the legacy ``domain_name`` / ``domain`` columns on all 10 tables.

- Recreates the ``sgroups_for_domains`` composite UNIQUE on ``(scaling_group, domain_id)`` (currently still on the legacy ``domain`` column).

- Provides downgrade that re-adds the column, backfills from ``domains.name`` via ``domain_id`` join, and restores the legacy unique constraint.

2. ORM Row classes: remove the legacy column attribute on each of the 10 Row classes; flip ``domain_id`` from ``DomainID | None`` to ``DomainID``; update ``ScalingGroupForDomainRow.__table_args__`` to use ``domain_id`` in the composite UNIQUE.

3. Search filters: rewrite the ``by_domain_name_\*`` filters in ``models/{session,user,group,endpoint,model_card}/conditions.py`` to filter through ``DomainRow.name`` via EXISTS / scalar subquery against ``domain_id``. Keep the filter signature accepting domain name strings — the external search API contract is unchanged in this story (API ID migration is BA-6045).

4. INSERT call sites: every place that currently constructs a Row or executes a raw INSERT with only the legacy ``domain_name`` / ``domain`` field must be updated to populate ``domain_id`` instead. Covered creators include:

- ``repositories/group/creators.py`` (GroupCreatorSpec)

- ``repositories/user/creators.py`` (UserCreatorSpec)

- ``repositories/scheduler/creators.py`` (SessionRow / KernelRow creators)

- ``repositories/model_serving/creators.py`` (EndpointRow / EndpointTokenRow creators)

- ``repositories/deployment/creators/{deployment,route,token}.py``

- ``repositories/model_card/creators.py``

- ``repositories/scaling_group/creators.py`` (ScalingGroupForDomainCreatorSpec)

- Raw inserts referencing ``groups.c.domain_name`` etc.

5. Repository / service / utils call sites: every read of ``row.domain_name`` or ``users.c.domain_name`` (and equivalents on the 9 other tables) must be migrated to either:

- ``row.domain_id`` (when the caller actually needs the identifier), or

- ``row.domain.name`` / explicit ``DomainRow.name`` join (when the caller needs the human-readable name).

Includes: ``manager/utils.py``, ``manager/registry.py``, ``sokovan/``, ``fair_share/``, ``repositories/{user,group,vfolder,fair_share,scheduler,permission_controller}/``.

6. Internal pipeline: any dataclass / parameter / kwarg currently named ``domain_name`` that carries a string sourced from one of the 10 tables should be switched to ``domain_id: DomainID`` where the value is only used as an identifier downstream. Conversions to the human-readable name happen at the read boundary.

7. Tests: update fixtures and test helpers that construct rows with ``domain_name=...`` to also pass ``domain_id=...`` (or only ``domain_id=...`` once the legacy column is dropped).

Out of scope

- External REST/GraphQL/SDK/CLI identifier migration — BA-6045.

- RBAC scope (DomainScope) migration — BA-6047. DomainScope continues to carry the domain name string; this story converts the FK-column-derived strings, not the RBAC scope identifier.

Dependencies

- Requires BA-6046 (FK column added, FK constraint moved, PK swap landed).

- Should land before BA-6047 (RBAC migration) so RBAC code can rely on a clean ``domain_id`` source on the referencing tables.

JIRA Issue: BA-6122