feat: yoyaku_manager: tenant- and resource-type-scoped manager grants

Adds tenant- and resource-type-scoped manager grants, so a team can manage every resource of a tenant or of a type without being granted each resource one at a time.

Closes #3612851.

Why

Managers could be assigned only per resource. That fits venues run independently (a mountain refuge per team), but not a venue like an auditorium where one team runs every event: re-granting the team on each event is tedious and error prone.

Model

The resource-only yoyaku_resource_manager becomes one polymorphic yoyaku_manager_grant entity scoped at resource, type or tenant (pre-1.0, no migration). A user may hold any mix of grants; the resources they manage are the union of what all their grants resolve to, so a tenant grant, type grants and resource grants combine.

GrantResourceResolver (replacing the junction resolver, same tag) turns each grant into resource ids: a resource grant to itself, a type grant to every resource of that type, a tenant grant to every resource of that tenant. It is cache-tagged on the grant and resource lists, so a resource added later under a granted type or tenant is covered automatically. Enforcement is unchanged: the access handler, query alters and actions still sit on managedResourceIds().

UI

Each scope is edited on its own entity's Managers tab, alongside Edit: the resource, the resource type and the tenant pages each gain one, mirroring the existing per-resource tab. Grant authority stays per tenant. The tenant edit form gains its default Edit task so its tab bar is complete.

Tests

Kernel coverage for each scope, their union, expiry, and the existing access/action/bulk-form suites updated to the new entity.