[DOM-75520] fix: enforce owner-based RBAC on all job endpoints

[ddl-subir-m]

Why

Security issue: All job endpoints are currently accessible by any authenticated user regardless of ownership. A user can read, cancel, or delete jobs they don't own. The job listing endpoint also accepts a client-supplied owner parameter, which could be used to enumerate other users' jobs.

Additionally, the user identity resolution had the wrong priority: get_request_owner() preferred get_viewing_user() (sidecar API) over the domino-username header. In the App context, the sidecar always returns the App owner's identity, not the actual viewing user's. This meant all RBAC checks were comparing against the App owner instead of the browser user.

The clear_viewing_user() fix prevents user context from leaking between requests in the same process.

Depends on

• PR [DOM-75514] feat: core HTTP layer enhancements + debug middleware #14 (HTTP layer)
• PR [DOM-75517] feat: EDA results DB model + diagnostics_data + CRUD enhancements #15 (DB schema — summary_only, owner filtering in CRUD)

Summary

Security fixes

• _enforce_job_owner() on all single-job endpoints (get, status, metrics, progress, cancel, delete, logs) — returns 404 to non-owners to avoid leaking job existence
• resolve_job_list_filters() ignores client-supplied owner — always resolves server-side from authenticated user
• get_request_owner() inverted: prefers domino-username header (trusted, Domino proxy) over sidecar user (returns App owner)
• clear_viewing_user() prevents cross-request user context leakage

Other improvements

• JobListItemResponse lightweight schema for dashboard (excludes leaderboard/diagnostics blobs)
• Owner filtering on cleanup operations and registered models
• needs_request flag in compat route patterns for forwarding Request to RBAC endpoints
• Background Domino sync throttling to avoid blocking list endpoints
• Zombie local job detection for OOM'd training tasks

Files changed

• app/services/job_service.py — RBAC enforcement, owner resolution, background sync
• app/api/schemas/job.py — JobListItemResponse
• app/api/routes/jobs.py — Request forwarding for owner enforcement
• app/api/compat/patterns.py — needs_request flag
• app/api/compat/custom_jobs.py — owner enforcement on compat routes
• app/api/compat/custom_models.py — owner filtering on models
• app/services/model_service.py — owner param on registered models
• app/core/context/user.py — clear_viewing_user()
• app/core/leaderboard_utils.py — leaderboard normalization helpers (dependency)
• app/main.py — clear user context after each request
• tests/test_job_service.py — updated + new RBAC tests
• tests/test_compat_jobs.py — compat route tests
• tests/test_auth_header_concurrency.py — concurrency tests

Test plan

• test_job_service.py passes
• test_compat_jobs.py passes
• test_auth_header_concurrency.py passes
• Non-owner gets 404 on single-job endpoints
• Job listing ignores client-supplied owner
• domino-username header takes priority over sidecar