feat(rbac,cli): RoleBinding typed nullable FKs + credential bind subcommand (#1581)

## Summary

- **RoleBinding model refactor**: replaces polymorphic `scope_id string`
with typed nullable FK columns (`user_id *string`, `project_id`,
`agent_id`, `session_id`, `credential_id`). Exactly one FK is non-null
per row; `user_id` is independently nullable (credential→project
bindings set both `credential_id` and `project_id` with `user_id=NULL`).
- **DB migration** (`202505130001`): drops `scope_id`, makes `user_id`
nullable, adds the four typed FK columns with indexes. Safe on fresh and
existing DBs via `IF EXISTS` guards.
- **`acpctl credential bind`**: new CLI subcommand that resolves a
credential by name, then creates a `RoleBinding` with
`scope=credential`, `credential_id`, and `project_id`.
- **Spec reconciliation**: spec coverage matrix, Agent ERD,
ScheduledSession fields, RBAC routes, and status header updated to match
implementation.
- **NetworkPolicy**: runner pods can now receive ingress from any source
(required for operator→runner calls).

## Changed components

| Component | Change |
|---|---|
| `ambient-api-server` plugins/roleBindings | model, migration, handler,
presenter, openapi schema, generated types |
| `ambient-sdk` (Go, Python, TS) | typed FK fields on RoleBinding;
`user_id` nullable; `scope_id` removed |
| `ambient-cli` credential/create/get | `credential bind` command; typed
FK flags; `*string` UserID handling |
| `specs/api/ambient-model.spec.md` | coverage matrix, Agent ERD,
ScheduledSession, RBAC routes, status |
| `components/manifests` | NetworkPolicy runner ingress rules |

## Test plan

- [ ] `cd components/ambient-api-server && go build ./... && go vet
./...` passes
- [ ] `cd components/ambient-cli && go build ./... && go vet ./...`
passes
- [ ] `plugins/roleBindings` integration test: create binding with
`scope=project`, `project_id` set, `user_id` null
- [ ] `acpctl credential bind <name> --project <project>` creates a
RoleBinding with `scope=credential`
- [ ] Existing role-binding list/get/create/delete commands unaffected

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added `credential bind` CLI command for binding credentials to
projects.

* **Improvements**
* Role bindings now target resources via dedicated identifiers
(project/agent/session/credential) instead of a single scope ID.
* CLI role-binding commands use dedicated flags (e.g., --project-id-fk,
--agent-id-fk, --session-id-fk, --credential-id-fk).
* SDKs/CLI builders updated to accept optional target identifiers and
optional user IDs.

* **UI**
* Role binding list output shows "TARGET" column for the chosen target
identifier.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Ambient Code Bot <bot@ambient-code.local>

Author: 3 people

components/ambient-api-server/openapi/openapi.roleBindings.yaml

@@ -219,18 +219,34 @@ components:
         - $ref: 'openapi.yaml#/components/schemas/ObjectReference'
         - type: object
           required:
-            - user_id
             - role_id
             - scope
           properties:
-            user_id:
-              type: string
             role_id:
               type: string
             scope:
               type: string
-            scope_id:
+              enum: [global, project, agent, session, credential]
+            user_id:
+              type: string
+              nullable: true
+              description: Nullable — set when the binding is user-specific
+            project_id:
+              type: string
+              nullable: true
+              description: Nullable — set when scope=project or when binding a credential to a project
+            agent_id:
+              type: string
+              nullable: true
+              description: Nullable — set when scope=agent
+            session_id:
+              type: string
+              nullable: true
+              description: Nullable — set when scope=session
+            credential_id:
               type: string
+              nullable: true
+              description: Nullable — set when scope=credential
     # NEW SCHEMA START
     RoleBindingList:
     # NEW SCHEMA END
@@ -247,14 +263,26 @@ components:
     # NEW SCHEMA END
       type: object
       properties:
-        user_id:
-          type: string
         role_id:
           type: string
         scope:
           type: string
-        scope_id:
+          enum: [global, project, agent, session, credential]
+        user_id:
+          type: string
+          nullable: true
+        project_id:
+          type: string
+          nullable: true
+        agent_id:
+          type: string
+          nullable: true
+        session_id:
+          type: string
+          nullable: true
+        credential_id:
           type: string
+          nullable: true
   parameters:
       id:
         name: id