Add IdleChecker.sessionChecks and the root scoped SessionIdleCheck query

The checker side of the SessionIdleCheck relation: a sessionChecks connection on IdleChecker and a root scopedSessionIdleChecks query whose scope takes session and checker lists OR'd together, per the Relations rules in src/ai/backend/manager/api/gql/AGENTS.md. Filters on the relation type cover excluded and effective and nest session conditions (id, name, project). Results are limited to sessions visible to the caller. Built on BA-7245 and the connection base from BA-7887.

## Success Criteria
- [ ] checker-scoped reads return only that checker's pairs
- [ ] excluded/effective filters produce correct subsets
- [ ] sessions invisible to the caller are excluded
- [ ] pants test passes for affected packages

JIRA Issue: BA-7246

Start with the Relations rules in src/ai/backend/manager/api/gql/AGENTS.md, then trace the existing IdleChecker and SessionIdleCheck relation implementations. Run the pants test for the affected packages while checking checker scoping, excluded/effective and nested session filters, and caller-visible session limits. Done means all listed success criteria pass.

Written by the indexing model from the issue text.