revert(BA-3696): Remove user UUID query from legacy GQL handlers

Revert the user_uuid DB lookups added to ModifyUser, DeleteUser, and
PurgeUser mutations in gql_legacy/user.py back to main state. The API
handler layer should not perform direct DB queries.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: fregataa

src/ai/backend/manager/api/gql_legacy/user.py

@@ -956,9 +956,7 @@ class ModifyUserInput(graphene.InputObjectType):  # type: ignore[misc]
         description="Added in 25.2.0. Supplementary group IDs assigned to processes running inside the container.",
     )
 
-    def to_action(
-        self, email: str, user_uuid: UUID, graph_ctx: GraphQueryContext
-    ) -> ModifyUserAction:
+    def to_action(self, email: str, graph_ctx: GraphQueryContext) -> ModifyUserAction:
         # Create PasswordInfo if password is being changed
         password_state = OptionalState[PasswordInfo].nop()
         if self.password is not Undefined and self.password is not None:
@@ -1029,7 +1027,6 @@ def to_action(
         )
         # Note: User update uses email for lookup, pk_value is not used
         return ModifyUserAction(
-            user_uuid=user_uuid,
             email=email,
             updater=Updater(spec=spec, pk_value=email),
         )
@@ -1046,11 +1043,8 @@ class PurgeUserInput(graphene.InputObjectType):  # type: ignore[misc]
         ),
     )
 
-    def to_action(
-        self, email: str, user_uuid: UUID, user_info_ctx: UserInfoContext
-    ) -> PurgeUserAction:
+    def to_action(self, email: str, user_info_ctx: UserInfoContext) -> PurgeUserAction:
         return PurgeUserAction(
-            user_uuid=user_uuid,
             user_info_ctx=user_info_ctx,
             email=email,
             purge_shared_vfolders=OptionalState[bool].from_graphql(
@@ -1125,15 +1119,7 @@ async def mutate(
 
         validate_user_mutation_props(props)
 
-        # Fetch user UUID first (needed for RBAC validation)
-        async with graph_ctx.db.begin_readonly_session() as db_session:
-            user_uuid = await db_session.scalar(
-                sa.select(users.c.uuid).where(users.c.email == email)
-            )
-        if user_uuid is None:
-            raise UserNotFound
-
-        action: ModifyUserAction = props.to_action(email, user_uuid, graph_ctx)
+        action: ModifyUserAction = props.to_action(email, graph_ctx)
         res: ModifyUserActionResult = await graph_ctx.processors.user.modify_user.wait_for_complete(
             action
         )
@@ -1168,16 +1154,7 @@ async def mutate(
         email: str,
     ) -> DeleteUser:
         graph_ctx: GraphQueryContext = info.context
-
-        # Fetch user UUID first (needed for RBAC validation)
-        async with graph_ctx.db.begin_readonly_session() as db_session:
-            user_uuid = await db_session.scalar(
-                sa.select(users.c.uuid).where(users.c.email == email)
-            )
-        if user_uuid is None:
-            raise UserNotFound
-
-        action = DeleteUserAction(user_uuid=user_uuid, email=email)
+        action = DeleteUserAction(email)
         await graph_ctx.processors.user.delete_user.wait_for_complete(action)
         return cls(
             ok=True,
@@ -1219,21 +1196,12 @@ async def mutate(
         props: PurgeUserInput,
     ) -> PurgeUser:
         graph_ctx: GraphQueryContext = info.context
-
-        # Fetch user UUID first (needed for RBAC validation)
-        async with graph_ctx.db.begin_readonly_session() as db_session:
-            user_uuid = await db_session.scalar(
-                sa.select(users.c.uuid).where(users.c.email == email)
-            )
-        if user_uuid is None:
-            raise UserNotFound
-
         user_info_ctx = UserInfoContext(
             uuid=graph_ctx.user["uuid"],
             email=graph_ctx.user["email"],
             main_access_key=graph_ctx.user["main_access_key"],
         )
-        action = props.to_action(email, user_uuid, user_info_ctx)
+        action = props.to_action(email, user_info_ctx)
 
         await graph_ctx.processors.user.purge_user.wait_for_complete(action)