Expose kernel attached devices via KernelV2.attachedDevices connection and kernel-scoped REST v2 endpoint

Expose the kernel attached-device data in the v2 API.

GQL:
- attachedDevices connection field on KernelV2 (api/gql/kernel/types.py), following the Deployment.replicas / AgentV2.kernels connection pattern.
- Node type mirrors AttachedDeviceEntry: deviceName, deviceId, modelName, capacities as name/value entries (DeviceCapacityEntry projection of the junction data map).
- Authorization is inherited from kernel node reachability: reaching the KernelV2 node already means the caller passed kernel read authorization, so the field follows the kernel access permission for free.

REST:
- Kernel-scoped v2 endpoint following the scheduling-history surface structure (api/rest/scheduling_history precedent).
- Authorization via ResolveKernelSessionAction resolving the kernel to its owning session and checking session access (api/adapters/scheduling_history/adapter.py precedent) - no separate permission model.

DTO:
- Response DTOs under common/dto/manager/v2 mirror the entry models, following the ResourceSlotEntryInput precedent so the same entry list flows through API, service, and repository layers without re-shaping.

Data source: kernel_devices joined with devices - device identity fields (deviceName, deviceId, modelName) from the entity table, capacities projected from the junction data.

Success Criteria
- [ ] KernelV2.attachedDevices returns device entries with capacities for a kernel the caller can read
- [ ] the REST endpoint returns the same data for an authorized caller; a caller without access to the owning session is rejected
- [ ] a kernel with no devices returns an empty connection, not an error
- [ ] capacities expose name/value pairs projected from the junction data map
- [ ] pants test passes for affected packages

JIRA Issue: BA-7180

Start with api/gql/kernel/types.py and compare the Deployment.replicas and AgentV2.kernels connection patterns. Then read api/rest/scheduling_history and api/adapters/scheduling_history/adapter.py, plus the ResourceSlotEntryInput precedent under common/dto/manager/v2. Done means matching GraphQL and REST data, capacity name/value projections, correct session authorization, an empty result for kernels without devices, and passing pants tests for affected packages.

Written by the indexing model from the issue text.