Add a least-privilege role scoped to credential-resolution / signature-delegation (avoid requiring superadmin)

## Problem

Resolving an arbitrary access key today requires **superadmin**: the legacy keypair query is gated by `@scoped_query(autofill_user=True, user_key="access_key")`, so a superadmin may resolve any key while a domain-admin resolves only keys in its own domain. A satellite gateway that must resolve *any* user's key in a multi-domain deployment therefore has to run with a **superadmin** service credential (or one instance per domain).

Superadmin is far more authority than "verify a signature / resolve one keypair's secret + identity" needs, concentrating unnecessary blast radius in a network-exposed service.

## Request

A dedicated, least-privilege **role/permission** that authorizes exactly the credential-resolution or signature-delegation API from ask #1 — cross-domain where required — and **nothing else** (no vfolder mutation, no user management, no session control). Ideally expressible in the RBAC model so it can be granted to a service principal.

## Rationale

- Satellite services are volume-privileged already; minimizing their **Manager-side** authority is the meaningful hardening lever.
- A scoped role lets operators grant BAIFS credential-resolution without handing it superadmin, shrinking the impact of a stolen service credential.
- Pairs naturally with ask #1's delegation endpoint (the role authorizes the delegation call).

## Citations (`6d680960d`)

- `@scoped_query(autofill_user=True, user_key="access_key")` on the legacy keypair resolver (`manager/api/gql_legacy/schema.py` / `gql_legacy/keypair.py`) — superadmin resolves any key; domain-admin only within-domain.
- BAIFS threat model treating the admin credential as a concentrated capability: [docs/02 §5](../../02-authentication.md).

---
_Filed from the BAIFS project: see lablup/BAIFS#6 and `docs/spikes/upstream-asks/02-least-privilege-role.md` for full context and citations._

Start with the legacy resolver in manager/api/gql_legacy/schema.py and gql_legacy/keypair.py, then read docs/spikes/upstream-asks/02-least-privilege-role.md and docs/02-authentication.md. Trace the RBAC model and the credential-resolution or signature-delegation API described in the issue. Done means a service principal can authorize that cross-domain capability without gaining vfolder, user-management, or session-control authority.

Written by the indexing model from the issue text.