feat(BA-6874): wire compute-schedule into the API handler

[fregataa]

Summary

• Wire the compute-schedule (dry-run) GraphQL resolver through the session adapter to the service, so callers can invoke the query end-to-end (resolver → adapter → service → scheduling controller). Previously the resolver was a schema-only stub raising ServiceUnavailable.
• Resolve the caller's main access key server-side (in the service, from user_uuid via the user repository) instead of passing a hardcoded value from the adapter.
• Extend the response payload to carry the full remediation breadth the internal data type already exposes: UnschedulableReasonHint.required_container_reduction / image_not_found and ComputeSchedulePayload.resource_group_reason (new GraphQL fields use gql_added_field).

Known limitation (draft)

The end-to-end path is not yet functional at runtime: the compute_schedule service builds a SessionSpecDraft whose scope.domain_id / domain_name / project_id are unset, so the shared SessionSpec finalize validation (session_spec_preparer._finalize) rejects every request with IncompleteSessionSpec before node-fitting runs. These scope fields are consumed only by the enqueue persistence path (scheduler/creators.py) and are dead weight for the DB-mutation-free dry-run. Resolving this (populate scope from the user vs. relax the validation for this path) is deferred and tracked separately; this PR lands the wiring + payload surface.

Test plan

• pants fmt / fix / lint / check pass
• GraphQL schema builds; new payload fields (requiredContainerReduction, imageNotFound, resourceGroupReason) exposed in SDL
• Live GQL query reaches resolver → adapter → service → controller (verified request flow; blocked at the scope validation described above)
• End-to-end success for admin and non-admin (blocked on the scope limitation above)

Resolves BA-6874