Purge app config fragments by config name in the repository and service layers

## Objective

An app config fragment is addressed by (scope, config_name) everywhere except delete, which takes a fragment id. Add the scope-addressed purge underneath: a repository operation that resolves config names to fragments at one scope and purges them all-or-nothing inside a single write transaction, plus the service action that gates it.

## Background

Resolving names client-side and then purging by id cannot guarantee the two steps see the same rows, so the resolution belongs inside the purging transaction. The RBAC gate is the purge permission at the scope written, matching the single-scope gate the scoped upsert crosses rather than the per-fragment gate a purge by id crosses. No new action infrastructure is needed: ScopeActionProcessor, validators.rbac.scope and AppConfigFragmentScopeAction already exist.

This issue stops at the service layer. The REST routes and the SDK/CLI that call it are tracked separately.

## Acceptance Criteria

- AppConfigFragmentRepository.purge_by_config_names(scope, config_names) purges only the named scope's fragments for those names and returns them in request order.
- A config name the scope holds no fragment for raises AppConfigFragmentNotFound before anything is deleted, leaving every row intact.
- A name repeated in the request purges the one fragment it names.
- Each purged fragment is unbound from its RBAC scope, as a purge by id is.
- A PURGE scope action carries the purge, and its result reports the RBAC scope it was authorized at for public, domain and user scopes.
- Repository tests run against a real DB; service tests are mocked.

## Related

- BA-7149 - the originating issue, which proposed composing two client-side calls instead; this issue supersedes that approach with a server-side transaction.
- src/ai/backend/manager/repositories/AGENTS.md
- src/ai/backend/manager/services/AGENTS.md

## Story Points

1

JIRA Issue: BA-7183

Read src/ai/backend/manager/repositories/AGENTS.md and src/ai/backend/manager/services/AGENTS.md, then locate AppConfigFragmentRepository and AppConfigFragmentScopeAction. Add the scope-addressed purge and its PURGE service action, covering the transaction, request ordering, duplicate names, RBAC unbinding, and authorization result. Run repository tests against a real DB and service tests with mocks.

Written by the indexing model from the issue text.