[Domain] Move users.domain_name FK to users.domain_id

Goal

Move the foreign key reference from ``users.domain_name`` (string, → ``domains.name``) to a new ``users.domain_id`` (UUID, → ``domains.id``). The legacy ``domain_name`` string column is retained without a FK constraint; its removal is deferred to BA-6122. ``domains`` itself keeps ``name`` as PK in this story — the PK swap on ``domains`` is BA-6046.

Scope

1. Alembic: single revision, parent ``down_revision = fdc9d6ac49b4``. Add ``users.domain_id`` UUID column (NULLABLE — ``users.domain_name`` is nullable). Backfill ``domain_id = domains.id`` via join on ``domains.name``. Drop the existing ``users.domain_name → domains.name`` FK. Create new ``users.domain_id → domains.id`` FK. Provide downgrade.

2. ORM: add ``domain_id: Mapped[DomainID \| None]`` on ``UserRow``; keep ``domain_name`` column (drop only its FK clause); update ``_get_domain_join_condition`` if needed so the ``users → DomainRow`` relationship joins via ``domain_id``.

3. Create / update specs: add ``domain_id: DomainID`` field to ``UserCreatorSpec``; add ``domain_id: OptionalState[DomainID]`` to ``UserUpdaterSpec``. Make ``build_row`` / ``build_values`` populate both legacy and new columns.

4. API entry points that build the spec from client input: convert ``domain_name`` → ``domain_id`` via ``ResolveDomainIDByNameAction`` (already exists). Affected: ``api/rest/user/handler.py``, ``api/adapters/user/adapter.py``, ``api/gql/user/resolver/mutation.py``, ``api/gql_legacy/user.py``.

5. Tests: update fixtures that construct ``UserRow`` directly so ``domain_id`` is populated alongside ``domain_name``.

Parallelism

This story does NOT depend on the other 9 referencing-table stories; they may all proceed in parallel. The 10 stories will each emit an Alembic revision pointing at the same ``down_revision``, producing multiple heads. The heads are consolidated by an ``alembic merge`` revision under BA-6046 before the ``domains`` PK swap lands.

Out of scope

- ``domains`` PK swap — BA-6046.

- Legacy ``domain_name`` column drop and search-filter / propagation cleanup — BA-6122.

- RBAC scope migration — BA-6047.

JIRA Issue: BA-6123

Start with the Alembic revision using down_revision fdc9d6ac49b4, then trace UserRow, UserCreatorSpec, UserUpdaterSpec, and the affected REST and GraphQL entry points: api/rest/user/handler.py, api/adapters/user/adapter.py, api/gql/user/resolver/mutation.py, and api/gql_legacy/user.py. Done means domain_id is backfilled and constrained, ORM/spec builders and API conversions populate both columns, and direct UserRow fixtures are updated with passing tests and a working downgrade.

Written by the indexing model from the issue text.