[Auth] Move the legacy GraphQL context onto the typed auth context

## Objective

Type GraphQueryContext.user as AuthenticatedUser and move the legacy Graphene resolvers off dictionary subscripts.

## Background

Split out of BA-7173, which types what the REST auth middleware puts on the request. The legacy Graphene layer reaches that value through exactly one construction site — api/rest/admin/handler.py builds GraphQueryContext(user=request["user"], ...) — so BA-7173 keeps that one line serializing the dataclass and leaves gql_legacy untouched. This issue removes that line and finishes the migration.

GraphQueryContext.user is declared Mapping[str, Any] with a "TODO: express using typed dict" comment. 93 sites read ctx.user["role"] / ["domain_name"] / ["uuid"] / ["email"] / ["main_access_key"], plus about 40 more through locals bound from it.

## Acceptance Criteria

- GraphQueryContext.user is AuthenticatedUser; the TODO comment goes away.
- Every ctx.user subscript becomes attribute access, and the type checker covers them.
- The serialization at api/rest/admin/handler.py is removed, so no dictionary form of the auth context remains anywhere.
- Legacy GraphQL test fixtures build AuthenticatedUser rather than a dict; the suites stay green.
- Nullability the typing surfaces is decided explicitly rather than propagated (for example a caller whose main_access_key is unset).

## Related

- BA-7173 — types the auth context and moves the REST readers; this issue stacks on it.

JIRA Issue: BA-7188

Start with GraphQueryContext and the legacy Graphene resolvers, then inspect the single construction site in api/rest/admin/handler.py and the gql_legacy readers and fixtures. Replace the dictionary-form access throughout the legacy GraphQL layer, resolve the stated nullability cases, and run the legacy GraphQL suites to confirm the type checker and tests pass.

Written by the indexing model from the issue text.