Refuse purging a resource policy that keypairs, users or projects still reference

## Goal

Purging a keypair, user or project resource policy that is still referenced refuses with a domain error saying so, before the delete reaches the database.

## Background

KeyPairResourcePolicyPurger, UserResourcePolicyPurger and ProjectResourcePolicyPurger (src/ai/backend/manager/models/resource_policy/purgers.py) return no conflict_checks(). keypairs.resource_policy, users.resource_policy and groups.resource_policy are NOT NULL foreign keys onto the policy name, so the DELETE fails with a foreign-key violation and the caller gets the repository's ForeignKeyViolationError (409) with the database's text.

The scenario rows purging-a-\*-policy-still-held-is-refused pin the current behaviour; they and api/adapters/resource_policy/KNOWLEDGE.md change with this.

## Acceptance criteria

- Each purger declares a ConflictCheck against the referencing table, raising an error under manager/errors/ that names the policy and what still references it.
- The KNOWLEDGE.md rows and the scenario tests expect the new refusal.

## Related

- BA-7809

JIRA Issue: BA-7840

Start with src/ai/backend/manager/models/resource_policy/purgers.py and the existing purging-a-*-policy-still-held-is-refused scenario rows to trace the three purgers and their current database failure. Then inspect manager/errors/ and api/adapters/resource_policy/KNOWLEDGE.md; done means each purger refuses the purge with a domain error naming the policy and its references, with the scenario expectations and knowledge rows updated.

Written by the indexing model from the issue text.