Add the SessionIdleCheck relation type read path

Read path for session and idle checker relation rows as the SessionIdleCheck relation type: not a Node, no id field, no node(id) lookup and no data loader, per the Relations rules in src/ai/backend/manager/api/gql/AGENTS.md. A Searcher over session_idle_checks, joined to idle_checker_bindings and idle_checkers for the source conditions, read through the v2 read ops with session and checker scope items OR'd together. Each row carries the checker, sources[{scope, enabled}], excluded, effective = NOT excluded AND any(source.enabled), expire_at, last_status and last_message. The GraphQL fields are BA-7281 (session side) and BA-7246 (checker side and root query).

## Success Criteria
- [ ] checker applied through two scopes: one row with two sources
- [ ] disabled source and excluded pair produce correct enabled/excluded/effective values
- [ ] session and checker scope items are OR'd; a scope the caller cannot read is refused
- [ ] pants test passes for affected packages

JIRA Issue: BA-7245

Start with the Relations rules in src/ai/backend/manager/api/gql/AGENTS.md, then trace the existing v2 read ops and the Searcher for session_idle_checks. Check the GraphQL fields named BA-7281 and BA-7246 and run the pants tests for the affected packages. Done means the scope, source, exclusion, effective-state, expiry, and status fields satisfy all listed success criteria.

Written by the indexing model from the issue text.