Redesign SurrealDB auth model for virtual keys

[CLoaKY233]

• Introduce virtual_key_access and backend_service access levels
• Add fn::backend_fetch_secret and proxy_resolve_route with scoped permissions
• Update model_catalog, provider_credential, virtual_api_key, and request_log schemas
• Add full redesign blueprint (dbdesign/schema_redesign.surql) for migration

Summary

Closes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing behaviour to change)
• Refactor (no behaviour change)
• Documentation update
• CI / tooling change

Changes

Testing

• cargo test passes
• cargo clippy --all-targets --all-features -- -D warnings passes
• cargo fmt --all -- --check passes
• Manual testing performed (describe below)

Checklist

• I have read the CONTRIBUTING guide.
• The change is covered by tests or an explanation is provided for why tests are not applicable.
• Documentation has been updated where necessary (README, CHANGELOG, inline docs).
• No credentials, keys, or sensitive values are present in the diff.
• CHANGELOG.md has been updated under [Unreleased].

Notes for Reviewers