Resolves #12971 (BA-6943)

Summary

• Routes the session, deployment and route scheduling-history scoped searches through the RBAC scope chain. Each defines a SearchableActionTarget mapping to both an RBAC element (SESSION / MODEL_DEPLOYMENT / ROUTING) and a search scope; the actions extend BaseBulkAction and the processors run through BulkActionProcessor with validators.rbac.bulk.
• Previously these actions carried a SearchScope built straight from request input and exposed no RBAC element, so validators.rbac never ran — the repository turned the scope into a WHERE clause and existence_checks only confirmed the entity existed, not that the caller could read it. The routes papered over this by requiring super-admin, which made the scoped variants useless to the users who actually own the entities.
• The three scoped routes now drop to auth_required. With authorization enforced on the action path, a user can read the scheduling history of a session/deployment/route they hold, and gets PermissionDeniedError for one they do not — not a silently empty page. The unscoped admin searches stay superadmin_required.
• Handlers lose the admin_ prefix, which no longer describes them.

SchedulingHistoryProcessors.__init__ already accepted ActionValidators without using it; that was the wiring point. The repository now takes Sequence[SearchScope] so multiple authorized targets can be matched.

Independent of the BA-6889..BA-6893 kernel stack — branched from main, touches only the three pre-existing entities. search_kernel_scoped_history is deliberately untouched here (converted in #12869); doing it on both branches would conflict.

Test plan

• pants check clean (5251 source files)
• pants lint clean over src/ai/backend/:: and tests/unit/manager/::
• Scheduling-history service tests updated to the target shape and passing — each asserts the forwarded scopes and element_refs()
• Scheduling-history repository tests passing
• Confirmed BulkActionRBACValidator short-circuits for super admins, so the unscoped admin paths are unaffected
• Verified against a live manager: a non-admin reading their own session's history succeeds, and another user's is denied

🤖 Generated with Claude Code

📚 Documentation preview 📚: https://sorna--12974.org.readthedocs.build/en/12974/

📚 Documentation preview 📚: https://sorna-ko--12974.org.readthedocs.build/ko/12974/