Map resource policy name and constraint violations to domain errors

## Goal

Creating or updating a keypair, user or project resource policy refuses a duplicate name and a keypair priority cap outside the session priority range with a domain error of its own, instead of the repository's constraint-violation error.

## Background

KeyPairResourcePolicyCreator, UserResourcePolicyCreator, ProjectResourcePolicyCreator and the matching updaters (src/ai/backend/manager/models/resource_policy/) declare no integrity_error_checks, so the ops write path re-raises the parsed database error: UniqueConstraintViolationError for a name another policy holds (name is the primary key), CheckConstraintViolationError for max_priority outside SESSION_PRIORITY_MIN..MAX. Both surface to the API as a 409 whose text is the database's. DomainCreator maps the same duplicate-name case to InvalidAPIParameters.

The scenario tests under tests/scenario/bai_scenario/manager/resource_policy pin the current behaviour (rows \*-already-holds-is-refused, a-priority-cap-outside-the-session-range-is-refused, moving-the-priority-cap-outside-the-session-range-is-refused); they and api/adapters/resource_policy/KNOWLEDGE.md change with this.

## Acceptance criteria

- Each of the three creators and the keypair updater declares an IntegrityErrorCheck per constraint, raising an error under manager/errors/ that names the policy and the reason.
- The KNOWLEDGE.md rows for a duplicate name and an out-of-range priority cap name the new refusal, and the scenario tests expect it.
- No other adapter's report.md changes.

## Related

- BA-7809 (scenario research that found it)
- src/ai/backend/manager/models/domain/creators.py for the mapping shape

JIRA Issue: BA-7839

Start with src/ai/backend/manager/models/domain/creators.py for the existing mapping shape, then inspect the resource-policy creators and keypair updater under src/ai/backend/manager/models/resource_policy/. Run the scenario tests under tests/scenario/bai_scenario/manager/resource_policy and update the relevant rows plus api/adapters/resource_policy/KNOWLEDGE.md; done means duplicate names and out-of-range priority caps report the new domain refusals without changing other adapter report.md files.

Written by the indexing model from the issue text.