refactor(BA-5832): drop user-facing fragment/policy SDK + CLI surface

End users only interact with the merged AppConfig view (`my_get`,
`my_search` on `V2AppConfigClient`); raw fragment / policy reads were
just an API mirror without convention support. Removes:

- SDK `V2AppConfigFragmentClient.get` / `.scope_search` (the latter did
  not match the per-scope `{scope}_search()` convention used by
  `user.py`, `session.py`, `vfolder.py`, etc.)
- SDK `V2AppConfigPolicyClient.get` / `.search`
- CLI groups `./bai app-config-fragment` and `./bai app-config-policy`

Admin surface (`admin_search`, `admin_bulk_*`) is unchanged — both
clients keep the methods their `admin/` CLI counterparts call.

Author: jopemachine

src/ai/backend/client/cli/v2/__init__.py

@@ -256,25 +256,6 @@ def app_config() -> None:
     """App config (merged-view) commands."""
 
 
-@v2.group(
-    cls=LazyGroup,
-    import_name="ai.backend.client.cli.v2.app_config_fragment:app_config_fragment",
-    name="app-config-fragment",
-)
-def app_config_fragment() -> None:
-    """App config fragment commands."""
-
-
-@v2.group(
-    cls=LazyGroup,
-    import_name="ai.backend.client.cli.v2.app_config_policy:app_config_policy",
-    name="app-config-policy",
-)
-def app_config_policy() -> None:
-    """App config policy commands."""
-
-
-
 @v2.group(
     cls=LazyGroup,
     import_name="ai.backend.client.cli.v2.prometheus_query_preset:prometheus_query_preset",

src/ai/backend/client/cli/v2/app_config/__init__.py

@@ -0,0 +1,3 @@
+from .commands import app_config as app_config
+
+__all__ = ("app_config",)

src/ai/backend/client/cli/v2/app_config_fragment/__init__.py

@@ -1,4 +1,10 @@
-"""V2 SDK client for the app-config fragment domain (BEP-1052 §2)."""
+"""V2 SDK client for the app-config fragment domain (BEP-1052 §2).
+
+Fragments are an admin-only surface — end users interact with the merged
+``AppConfig`` view (``V2AppConfigClient``) instead. Self-service
+``my_bulk_*`` writes that return the recomputed merged view also live on
+``V2AppConfigClient`` alongside the merged-view reads.
+"""
 
 from __future__ import annotations
 
@@ -7,51 +13,24 @@
     AdminBulkCreateAppConfigFragmentsInput,
     AdminBulkPurgeAppConfigFragmentsInput,
     AdminBulkUpdateAppConfigFragmentsInput,
-    AppConfigFragmentKeyInput,
     SearchAppConfigFragmentsInput,
 )
 from ai.backend.common.dto.manager.v2.app_config_fragment.response import (
     AdminBulkCreateAppConfigFragmentsPayload,
     AdminBulkPurgeAppConfigFragmentsPayload,
     AdminBulkUpdateAppConfigFragmentsPayload,
-    GetAppConfigFragmentPayload,
     SearchAppConfigFragmentsPayload,
 )
 
 _PATH = "/v2/app-config-fragments"
 
 
 class V2AppConfigFragmentClient(BaseDomainClient):
-    """SDK client for AppConfigFragment raw-row operations.
+    """SDK client for AppConfigFragment admin operations.
 
-    Writes are bulk-only (BEP-1052 §3). Self-service `my_bulk_*`
-    writes return the recomputed merged AppConfig — they live on
-    `V2AppConfigClient` alongside the merged-view reads.
+    Writes are bulk-only (BEP-1052 §3).
     """
 
-    async def get(self, request: AppConfigFragmentKeyInput) -> GetAppConfigFragmentPayload:
-        """Read a single fragment by natural key."""
-        return await self._client.typed_request(
-            "POST",
-            f"{_PATH}/get",
-            request=request,
-            response_model=GetAppConfigFragmentPayload,
-        )
-
-    async def scope_search(
-        self,
-        scope_type: str,
-        scope_id: str,
-        request: SearchAppConfigFragmentsInput,
-    ) -> SearchAppConfigFragmentsPayload:
-        """Scope-bound search — caller pins `(scope_type, scope_id)`."""
-        return await self._client.typed_request(
-            "POST",
-            f"{_PATH}/{scope_type}/{scope_id}/search",
-            request=request,
-            response_model=SearchAppConfigFragmentsPayload,
-        )
-
     async def admin_search(
         self, request: SearchAppConfigFragmentsInput
     ) -> SearchAppConfigFragmentsPayload:

src/ai/backend/client/cli/v2/app_config_fragment/commands.py

@@ -1,4 +1,9 @@
-"""V2 SDK client for the app-config policy domain (BEP-1052 §1)."""
+"""V2 SDK client for the app-config policy domain (BEP-1052 §1).
+
+Policies are an admin-only surface — end users observe their effects
+through the merged ``AppConfig`` view (``V2AppConfigClient``), not by
+reading raw policy rows.
+"""
 
 from __future__ import annotations
 
@@ -7,43 +12,23 @@
     AdminBulkCreateAppConfigPoliciesInput,
     AdminBulkPurgeAppConfigPoliciesInput,
     AdminBulkUpdateAppConfigPoliciesInput,
-    SearchAppConfigPoliciesInput,
 )
 from ai.backend.common.dto.manager.v2.app_config_policy.response import (
     AdminBulkCreateAppConfigPoliciesPayload,
     AdminBulkPurgeAppConfigPoliciesPayload,
     AdminBulkUpdateAppConfigPoliciesPayload,
-    GetAppConfigPolicyPayload,
-    SearchAppConfigPoliciesPayload,
 )
 
 _PATH = "/v2/app-config-policies"
 
 
 class V2AppConfigPolicyClient(BaseDomainClient):
-    """SDK client for AppConfigPolicy operations.
+    """SDK client for AppConfigPolicy admin operations.
 
     Writes are bulk-only (BEP-1052 §3); single-item create / update /
     purge are intentionally absent.
     """
 
-    async def get(self, config_name: str) -> GetAppConfigPolicyPayload:
-        """Get a single policy by `config_name`."""
-        return await self._client.typed_request(
-            "GET",
-            f"{_PATH}/{config_name}",
-            response_model=GetAppConfigPolicyPayload,
-        )
-
-    async def search(self, request: SearchAppConfigPoliciesInput) -> SearchAppConfigPoliciesPayload:
-        """Paginated policy search (any authenticated user)."""
-        return await self._client.typed_request(
-            "POST",
-            f"{_PATH}/search",
-            request=request,
-            response_model=SearchAppConfigPoliciesPayload,
-        )
-
     async def admin_bulk_create(
         self, request: AdminBulkCreateAppConfigPoliciesInput
     ) -> AdminBulkCreateAppConfigPoliciesPayload: