fix(BA-3696): Derive scope info from creator.spec instead of requiring _domain_name parameter

- Remove _domain_name as a required field from CreateUserAction and CreateUserActionResult
- Derive domain_name from creator.spec.domain_name (UserCreatorSpec)
- Use TYPE_CHECKING and cast() to satisfy mypy without runtime imports
- Fixes 8 test call sites that were missing _domain_name parameter

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: fregataa

src/ai/backend/manager/services/user/actions/create_user.py

@@ -1,5 +1,7 @@
+from __future__ import annotations
+
 from dataclasses import dataclass
-from typing import override
+from typing import TYPE_CHECKING, cast, override
 
 from ai.backend.common.data.permission.types import RBACElementType, ScopeType
 from ai.backend.manager.actions.action import BaseActionResult
@@ -14,11 +16,13 @@
     UserScopeActionResult,
 )
 
+if TYPE_CHECKING:
+    from ai.backend.manager.repositories.user.creators import UserCreatorSpec
+
 
 @dataclass
 class CreateUserAction(UserScopeAction):
-    creator: Creator[UserRow]
-    _domain_name: str
+    creator: Creator[UserRow]  # spec: UserCreatorSpec
     group_ids: list[str] | None = None
 
     @override
@@ -32,17 +36,28 @@ def scope_type(self) -> ScopeType:
 
     @override
     def scope_id(self) -> str:
-        return self._domain_name
+        if TYPE_CHECKING:
+            from ai.backend.manager.repositories.user.creators import UserCreatorSpec
+
+            spec = cast(UserCreatorSpec, self.creator.spec)
+        else:
+            spec = self.creator.spec
+        return spec.domain_name
 
     @override
     def target_element(self) -> RBACElementRef:
-        return RBACElementRef(RBACElementType.DOMAIN, self._domain_name)
+        if TYPE_CHECKING:
+            from ai.backend.manager.repositories.user.creators import UserCreatorSpec
+
+            spec = cast(UserCreatorSpec, self.creator.spec)
+        else:
+            spec = self.creator.spec
+        return RBACElementRef(RBACElementType.DOMAIN, spec.domain_name)
 
 
 @dataclass
 class CreateUserActionResult(UserScopeActionResult):
     data: UserCreateResultData
-    _domain_name: str
 
     @override
     def entity_id(self) -> str | None:
@@ -54,7 +69,8 @@ def scope_type(self) -> ScopeType:
 
     @override
     def scope_id(self) -> str:
-        return self._domain_name
+        # UserCreateResultData always has domain_name set (from creator.spec.domain_name)
+        return self.data.user.domain_name or ""
 
 
 @dataclass

src/ai/backend/manager/services/user/service.py

@@ -102,7 +102,6 @@ async def create_user(self, action: CreateUserAction) -> CreateUserActionResult:
         )
         return CreateUserActionResult(
             data=user_data_result,
-            _domain_name=action.scope_id(),
         )
 
     async def bulk_create_users(self, action: BulkCreateUserAction) -> BulkCreateUserActionResult: