Apply the virtual scope chain to the user entity

Settle every scope operation of the `user` entity on the virtual scope chain. The wiring declares 7 scope operations for it; each one is accounted for below. Resolve ownership through `entity_memberships` joined to `virtual_scopes`; helpers live in `src/ai/backend/manager/models/virtual_scope/queries.py`.

## Convert

- `search_users_by_domain` — `UserRow.domain_name == :domain_name` (`models/user/scopes.py:32`)
- `export_users_by_domain_c_s_v` — the same predicate as a service lambda (`services/export/service.py:277`); catalogued under `export` but it reads user rows, so it settles here

## Already settled

- `search_users_by_project` — already reads the chain; the reference implementation
- `create_user` — the role-managed create path records the domain membership

## Out of scope

- `search_keypairs` — returns keypair rows, and `keypair` is catalogued as a field type under `user`. Worth noting: the other keypair operations declare `field=keypair` and this one declares `field=-`, which looks like a wiring slip
- `search_error_logs`, `search_login_history`, `search_login_sessions` — all field types under `user`

## Write side

Present. `models/user/creators.py:60` declares `member_of() -> (domain_id,)`.

## Done when

- No user read filters on a legacy ownership column.
- Each converted read has a test proving it returns the same rows as the column-based query on backfilled data.

JIRA Issue: BA-7545

Start with models/user/scopes.py:32 and services/export/service.py:277, then read the virtual-scope helpers in src/ai/backend/manager/models/virtual_scope/queries.py and the write-side declaration in models/user/creators.py:60. Convert the two listed user reads and add tests showing they return the same rows as the column-based queries on backfilled data; done means no user read filters on a legacy ownership column.

Written by the indexing model from the issue text.