Add adminScanImage GraphQL mutation for single-image rescan

Expose the canonical-only scan path from BA-7904 as a superadmin GraphQL mutation. The admin catalog UI already has a full-registry rescan; this adds the per-image counterpart, which must work for an image that has no row in the images table yet.

Schema (v2, Strawberry):

input ScanImageInput {
canonical: String!
}

type ScanImagePayload {
images: [ImageV2\!]\!
errors: [String\!]\!
}

type Mutation {
adminScanImage(input: ScanImageInput!): ScanImagePayload
}

Behaviour:

- superadmin only; check_admin_only() on the first line of the resolver.
- global scope; no domain or project scope argument.
- No architecture argument: every architecture in the manifest list is scanned, which is why the payload returns a list rather than a single image.
- A canonical without a tag resolves to latest, same as the CLI. Document this in the input field description.
- Synchronous, not a background task. A single tag is one manifest request plus one config blob per architecture.
- No V2 suffix on the mutation name: there is no v1 scanImage to collide with. The payload references the existing ImageV2 type.

Scope:

- common/dto/manager/v2/image/request.py and response.py: the existing RescanImagesInput / RescanImagesPayload pair is currently unreferenced by any code and mirrors the REST shape (architecture required, single item). Repurpose that pair as ScanImageInput / ScanImagePayload with the shape above rather than adding a new one.
- api/adapters/image/adapter.py: admin_scan_image(input) calling the action and converting to the DTO.
- api/gql/image/mutations.py (new): input and payload GQL types, following api/gql/container_registry/mutations.py.
- api/gql/image/resolver.py: the resolver, calling the adapter only, never the processor directly.
- api/gql/image/__init__.py and api/gql/schema.py: re-export and register on the Mutation type.
- Use the NEXT_RELEASE_VERSION constant for added_version; do not hardcode a version string.
- Regenerate the v2 SDL with scripts/generate-graphql-schema.sh and add a news fragment under changes/.
- Do not touch POST /image/rescan, POST /container-registries/rescan, the v1 rescanImages mutation, or mgr image rescan.

Success Criteria

- [ ] superadmin calls adminScanImage with a canonical absent from the images table -> payload contains the newly created image(s)
- [ ] a non-superadmin caller -> 403 Forbidden
- [ ] a multi-architecture image -> payload images contains one entry per architecture
- [ ] a canonical whose host is not a registered registry -> RegistryNotFoundForImage (404)
- [ ] a bare registry name passed as canonical -> error, and no full-registry scan runs
- [ ] partial per-architecture failures -> mutation still succeeds and the messages appear in errors
- [ ] the action is recorded in the audit log as a global-scope action
- [ ] scripts/generate-graphql-schema.sh output contains adminScanImage and the regenerated SDL is committed
- [ ] pants test passes for affected packages

JIRA Issue: BA-7905

Start with common/dto/manager/v2/image/request.py and response.py, then follow api/gql/container_registry/mutations.py into api/gql/image/mutations.py, resolver.py, adapter.py, __init__.py, and api/gql/schema.py. Run scripts/generate-graphql-schema.sh and the affected-package pants tests. Done means the listed success criteria pass, the SDL includes adminScanImage, and a news fragment is added under changes/.

Written by the indexing model from the issue text.