Metric catalog admin write management (create/update/delete/purge; no read op)

Write-only v2 slice for managing catalog bindings (create/update/delete/purge), mirroring the prometheus_query_preset write path: service + write actions, REST v2 handler/registry, adapter, GraphQL mutations, write DTOs, client SDK + CLI. Superadmin scope. Do NOT add get/search (read) ops - catalog read is served by the scope metrics endpoint plus the scoped permission check.

Success Criteria:
- [ ] create: valid binding -> persisted, returned with id.
- [ ] create: unknown preset_ref -> validation error.
- [ ] update/delete/purge behave per contract.
- [ ] No separate read (get/search) op added (read goes through the scope metrics endpoint).
- [ ] Non-admin denied.
- [ ] pants test passes for affected packages

JIRA Issue: BA-6753

Start by reading the existing prometheus_query_preset write path and comparing its service, write actions, REST v2 handler/registry, adapter, GraphQL mutations, write DTOs, client SDK, and CLI. Confirm the update/delete/purge contract and superadmin permission behavior before implementing the catalog-binding write operations. Run pants test for the affected packages; done means the success criteria pass, including no separate read operation.

Written by the indexing model from the issue text.