Expose unified resource-query API across REST v2, GraphQL, SDK and CLI

Expose the unified resource query (backed by the new service/repository) through the full v2 stack, with a single consistent response model replacing the inconsistent legacy usage_per_period / usage_per_month / month-stats shapes.

Scope (v2 full stack per CLAUDE.md):
- Shared v2 DTOs: common/dto/manager/v2/resource_query/ (single source for REST + GQL + SDK + CLI). Unified domain>project>session>kernel model with allocation + Prometheus-sourced utilization.
- REST v2: api/rest/v2/resource_query/ handler + api/adapters/resource_query.py adapter. Provide admin (unscoped) and scoped variants per the API layer guardrails.
- GraphQL: Strawberry type + resolver under api/gql/resource_query/ (NOT gql_legacy).
- Client SDK v2: client/v2/domains_v2/ typed request/response.
- CLI v2: client/cli/v2/ command calling the SDK.

Naming: use resource_query (NOT resource_usage) to avoid colliding with the existing api/rest/v2/resource_usage period-bucket stack.

Depends on the service/repository foundation issue (the adapter calls its processor/action).

## Success Criteria
- [ ] REST v2 endpoint returns the unified model for a project + time range (admin and scoped variants)
- [ ] GraphQL Strawberry query returns the same unified model
- [ ] The shared v2 DTO is the single schema used by REST, GQL, SDK and CLI
- [ ] Client SDK v2 + CLI v2 round-trip the new endpoint
- [ ] Verified against a live server via ./bai (admin and non-admin)
- [ ] pants test passes for affected manager and client packages

JIRA Issue: BA-6448