Resolve the personal project's resource policy by is_default instead of the name "default"

Provisioning a user writes that user's personal project, and the project creator names its resource policy with the literal "default". Nothing on the provisioning path can supply another name, so an install without a project resource policy called "default" cannot create a user at all.

What is there now:

- ProjectCreator.personal sets resource_policy="default" (models/project/creators.py).
- FullUserCreator carries user, keypair_secrets, keypair_resource_policy and keypair_rate_limit only, so the caller cannot name the project's policy (repositories/ops/v2/user/write.py).
- keypair_resource_policies has an is_default column with a partial unique index capping the mark at one row; project_resource_policies and user_resource_policies have no such column.
- No write spec sets keypair_resource_policies.is_default, so the existing mark cannot be produced through the v2 ops path.

Scope:

- Add is_default to project_resource_policies with the same partial unique index, and a migration for it.
- Have the personal project resolve its resource policy through that mark rather than the literal name.
- Add write specs that set the mark on keypair and project resource policies.

Found while building the scenario test tree in BA-7779: every scenario that lays an actor has to seed a project resource policy under a name it did not choose, which is the one place the tree cannot avoid a constant.

JIRA Issue: BA-7814

Start with models/project/creators.py and repositories/ops/v2/user/write.py, then inspect the existing keypair resource-policy migration and write specs for the partial unique index pattern. The work is done when project_resource_policies supports the default mark, personal projects resolve through it, and specs cover marking keypair and project policies.

Written by the indexing model from the issue text.