Redesign idle checker RBAC with scope-checker connections and session exclusion

Rework the 26.8 idle checker assignment RBAC model into the finalized design and add session-level exclusion.

Decisions:
- Checker definitions stay global entities; CRUD is superadmin-only
- Assignments are (scope, checker) connections expressed as scope-VS entity memberships with permission_cap=UPDATE; the separate IDLE_CHECKER_ASSIGNMENT RBAC entity type is removed
- Enable/disable is authorized against the single target-scope connection (scope-shape action), never across scopes
- Assignment create/delete is superadmin-only
- Session exclusion is a (checker, session) pair state with all-or-nothing validation and per-pair audit rows
- Exclusion is represented as an EXCLUDED phase of session_idle_checks.last_status (no separate column); effective = last_status != EXCLUDED AND any(enabled source)
- Exclusion resets when the assignment is unassigned or disabled, and re-inclusion restarts the pair at NOT_CHECKED (accepted trade-off)
- 26.8 API ships as-is; new contracts land in 26.9 with the old update contract deprecated

Phases: (1) RBAC re-contract, (2) session exclusion, (3) bidirectional GraphQL connections.

JIRA Issue: BA-7235

No files or tests are named. Start by locating the existing idle checker RBAC assignment flow and the session_idle_checks.last_status entry point, then compare the 26.8 API with the planned 26.9 contracts. Done means the three phases are implemented, session exclusion and reset behavior follow the stated rules, and the old update contract is deprecated.

Written by the indexing model from the issue text.