feat(BA-5514): register roles in association_scopes_entities with optional scope

[fregataa]

Summary

• Add optional scope registration when creating roles via ScopeInput (scope_type + scope_id)
• When scope is provided, RBACEntityCreator atomically creates the role row and its scope association; when absent, only the role row is created
• Move RBACElementTypeGQL to a new scope.py module to break the circular import chain and co-locate it with ScopeInputGQL

Test plan

• pants lint --changed-since=origin/main passes
• pants check passes (0 new errors)
• tests/unit/manager/api/gql/rbac/test_rbac_element_type_sync.py passes
• tests/unit/common/dto/manager/v2/rbac:: passes
• CI green

Resolves BA-5514

---

📚 Documentation preview 📚: https://sorna--10704.org.readthedocs.build/en/10704/

---

📚 Documentation preview 📚: https://sorna-ko--10704.org.readthedocs.build/ko/10704/

[Copilot]

Pull request overview

Adds optional scope registration when creating RBAC roles (so newly created roles can be atomically registered into association_scopes_entities when a scope is provided), and refactors GraphQL RBAC enum/type placement to avoid circular imports.

Changes:

• Thread optional scope_ref from GraphQL input → adapter → action/service → repository and use RBACEntityCreator to insert the scope association alongside role creation.
• Introduce ScopeInput (DTO + GQL) and move RBACElementTypeGQL into a new scope.py module to break circular imports.
• Update affected imports/exports and adjust enum sync test to the new module path.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/unit/manager/api/gql/rbac/test_rbac_element_type_sync.py	Updates enum import location after moving RBACElementTypeGQL.
src/ai/backend/manager/services/permission_contoller/service.py	Passes new scope_ref through to repository create-role input.
src/ai/backend/manager/services/permission_contoller/actions/create_role.py	Extends CreateRoleAction with optional scope_ref.
src/ai/backend/manager/repositories/permission_controller/role_manager.py	Uses RBACEntityCreator to register system roles in association_scopes_entities.
src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py	Conditionally uses RBACEntityCreator to create+register roles when scope_ref is provided.
src/ai/backend/manager/api/gql/rbac/types/scope.py	New module defining RBACElementTypeGQL and ScopeInputGQL.
src/ai/backend/manager/api/gql/rbac/types/role.py	Adds optional scope to GraphQL CreateRoleInput.
src/ai/backend/manager/api/gql/rbac/types/permission.py	Imports RBACElementTypeGQL from the new scope module.
src/ai/backend/manager/api/gql/rbac/types/entity.py	Imports RBACElementTypeGQL from the new scope module.
src/ai/backend/manager/api/gql/rbac/types/init.py	Re-exports RBACElementTypeGQL and new ScopeInputGQL.
src/ai/backend/manager/api/adapters/rbac.py	Converts optional GraphQL scope into internal RBACElementRef and passes it to CreateRoleAction.
src/ai/backend/common/dto/manager/v2/rbac/types.py	Adds ScopeInput request model.
src/ai/backend/common/dto/manager/v2/rbac/request.py	Extends CreateRoleInput (DTO) with optional scope.
src/ai/backend/common/dto/manager/v2/rbac/init.py	Exports ScopeInput.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.