Implement scope-based permission management for RBAC

Implement scope-based permission management system to align with GraphQL API specification.

## Branch Structure

This issue covers work in the `feat/BA-1810-rbac-repository-refactor` branch, which builds on top of `feat/BA-1810-types-and-infrastructure` (BA-3380).

**Branch Chain:**

```
main
→ feat/BA-1810-types-and-infrastructure (BA-3380: Types/Infrastructure)
→ feat/BA-1810-rbac-repository-refactor (BA-1810: This issue)
```

## Overview

Migrate from ID-based permission management to scope-based approach, allowing automatic discovery and creation of permission groups based on scope identifiers.

## Key Changes

### 1. New Type: ScopedPermissionCreateInput

Input for creating scoped permissions using `(scope_type, scope_id, entity_type, operation)` instead of explicit permission group IDs.

**Benefits:**

- System automatically finds or creates permission groups based on scope
- Aligns with GraphQL schema (rbac-schema.graphql)
- Simplifies API usage

### 2. Repository Layer Updates

#### Add Bulk Query Method

`_find_permission_groups_by_scopes(scopes: list[ScopeId]) -> dict[ScopeId, PermissionGroupRow]`

- Fetches multiple permission groups in single query
- Performance optimization for batch operations
- Returns mapping from scope to permission group

#### Rewrite update_role_permissions()

**New Workflow:**

1. Group permissions by scope
1. Use bulk query to minimize database lookups
1. Auto-discover/create permission groups by scope
1. All operations in single transaction

**Input Changes:**

- ❌ Removed: `add_permission_groups`, `remove_permission_group_ids`, `add_permissions`, `remove_permission_ids`
- ✅ Added: `add_scoped_permissions: list[ScopedPermissionCreateInput]`, `remove_scoped_permission_ids`

#### Remove Convenience Functions

- Remove `add_permissions_to_role()` (replaced by scope-based approach)
- Remove `remove_permissions_from_role()` (replaced by scope-based approach)

### 3. Filter-based Query Refactoring

Update `search_users_assigned_to_role()` to use filter-based role_id parameter:

- Replace explicit `role_id` parameter with `StrictValueFilter[UUID]`
- Consistent with other filter-based queries
- Uses infrastructure from BA-3380

## Breaking Changes

### RolePermissionsUpdateInput

**Before:**

```python
RolePermissionsUpdateInput(
role_id=role_id,
add_permission_groups=[scope_id],
add_permissions=[permission_creator]
)
```

**After:**

```python
RolePermissionsUpdateInput(
role_id=role_id,
add_scoped_permissions=[
ScopedPermissionCreateInput(
scope_type=ScopeType.DOMAIN,
scope_id=domain_id,
entity_type=EntityType.SESSION,
operation=OperationType.READ
)
]
)
```

## Benefits

- **API Alignment**: Matches GraphQL schema specification
- **Single Operation**: Add/remove multiple scoped and object permissions together
- **Performance**: Bulk queries for same-scope permissions
- **Automatic Management**: Permission groups created/discovered by scope
- **Cleaner API**: No manual permission group ID management

## Implementation Details

### Commits (4 total)

1. Add role_id parameter to search_users_assigned_to_role
1. Refactor search_users_assigned_to_role to use filter-based role_id
1. Migrate to scope-based permission management
1. Remove obsolete files

### Line Changes

~+1300/-140 lines

## Dependencies

**Depends on:**

- BA-3380: Types and infrastructure (feat/BA-1810-types-and-infrastructure)
- StrictValueFilter/UUIDFilter types
- Creator/Updater/Purger pattern implementation
- Basic repository/service/action integration

**Blocks:**

- BA-3377: RBAC DTOs and exceptions
- BA-3378: RBAC adapters
- BA-3379: RBAC handlers

## Reference

- GraphQL schema: `rbac-schema.graphql`

JIRA Issue: BA-1810