Apply the virtual scope chain to the vfolder entity

Settle every scope operation of the `vfolder` entity on the virtual scope chain. The wiring declares 9 scope operations for it; each one is accounted for below. Resolve ownership through `entity_memberships` joined to `virtual_scopes`; helpers live in `src/ai/backend/manager/models/virtual_scope/queries.py`.

## Convert

- `search_user_vfolders` — `VFolderRow.user == :uid OR VFolderRow.id IN (SELECT vfolder FROM vfolder_permissions ...)` (`models/vfolder/scopes.py:60`). Ownership becomes the user's virtual-scope membership; a shared folder becomes an `entity_memberships` row carrying a `permission_cap`
- `list_vfolder` — bounds its rows outside the scopes module; extract into an OperationScope first
- `search_storage_host_permissions` — same shape

## Already settled

- `search_vfolders_in_project` — carried by BA-7526
- `create_vfolder`, `create_vfolder_in_project`, `create_vfolder_v2` — the v2 create path records the owning user or project

## Out of scope

- `search_hosts` — returns storage hosts filtered by the keypair resource policy, not vfolder ownership
- `get_task_logs` — resolves one folder from a kernel; a single-row read, not a scoped list

## Write side

Present for the ownership arm. `models/vfolder/creators.py:60` declares the owning user or project. The sharing arm depends on BA-6877.

## Done when

- Owned folders and shared folders are both covered, with a test for each.
- Each converted read has a test proving it returns the same rows as the column-based query on backfilled data.

JIRA Issue: BA-7547

Start with the nine-operation wiring and read src/ai/backend/manager/models/virtual_scope/queries.py, then inspect models/vfolder/scopes.py:60 and models/vfolder/creators.py:60. Trace the three remaining read operations and the existing ownership path, then add tests for owned and shared folders and verify converted reads match the column-based query on backfilled data.

Written by the indexing model from the issue text.