Grant default model_card read permission on model-store project at creation and in fixtures

## Problem

Users who are bound to the model-store project scope cannot read model cards in that project unless the one-shot backfill migrations have already populated the project-scoped member role and its `model_card` `read` permission.

Concrete failure mode observed:

```

Insufficient permission to perform this operation.

(User lacks permission read on model_card at

RBACElementRef(element_type=RBACElementType.PROJECT, element_id=''))

```

## Root cause

The model-store project does not get a project-scoped member role + `model_card` `read` permission created by default in two code paths:

1. \***Domain creation**\* — `DomainRepository._create_model_store_group` (`src/ai/backend/manager/repositories/domain/repository.py:228`) only `INSERT`s a row into `groups`. Unlike the regular group creation flow (`src/ai/backend/manager/repositories/group/db_source/db_source.py:175-178`), it does not call `RBACEntityCreator` nor `RoleManager.create_system_role` (admin role + `ProjectMemberRoleSpec` member role). New domains created after the backfill migration therefore end up with a model-store project that has no member role at all.

2. \***Fixture insertion**\* — `populate_fixture` (`src/ai/backend/manager/models/base.py:875`) performs raw `INSERT`s of whatever rows are in the JSON. `fixtures/manager/example-users.json` contains the model-store group and user-to-project scope bindings (`association_scopes_entities`) but no `roles`, `permissions`, or `user_roles` entries. A fresh DB populated only by fixtures (without running the alembic backfill migrations) has no `model_card` permission rows on the model-store project.

The only path that currently grants this permission is the alembic migration pair, which runs once:

- `e3fb172166dc_backfill_project_member_roles.py` — creates member roles for all existing projects (including model-store) and adds `model_card` to `_MEMBER_ACCESSIBLE_ENTITY_TYPES`.

- `f1a2b3c4d5e6_add_model_card_permissions_to_rbac.py` — adds MODEL_CARD permissions to existing role+scope combinations.

## Proposed fix

1. Update `DomainRepository._create_model_store_group` to create the model-store project through `RBACEntityCreator` and create both the admin system role (via `GroupData`) and the member role (via `ProjectMemberRoleSpec`), mirroring the regular group creation path. This ensures the project-scoped member role + its `model_card` `read` permission row are produced on every new domain.

2. Update `fixtures/manager/example-users.json` to include the model-store project's admin and member roles, the corresponding `permissions` rows (with `model_card` `read` for the member role), and the role↔scope bindings in `association_scopes_entities`. This makes fixture-populated DBs match the post-migration state without depending on the one-shot backfill.

## Acceptance criteria

- Creating a new domain via the API produces a model-store project that immediately allows project-bound users to `read` model cards in that project, without running any backfill migration afterwards.

- A fresh DB populated solely from `fixtures/manager/example-users.json` (no alembic backfill) allows the fixture's `user@lablup.com` to `read` model cards on the model-store project.

- Existing behaviour for DBs that have already run the backfill migrations is unchanged (no duplicate rows, idempotent).

JIRA Issue: BA-6160

Read DomainRepository._create_model_store_group in src/ai/backend/manager/repositories/domain/repository.py alongside the regular group path in src/ai/backend/manager/repositories/group/db_source/db_source.py. Then inspect populate_fixture in src/ai/backend/manager/models/base.py and the model-store entries in fixtures/manager/example-users.json. Done means new domains and fixture-only databases provide the project member role and model_card read permission without duplicate rows after backfill migrations.

Written by the indexing model from the issue text.