feat: allow checks and folders to live in any Grafana folder, using the standard folder picker

[VikaCep]

Problem

The folders feature anchors everything under the default Grafana Synthetic Monitoring folder: the check form's folder dropdown only offers that subtree, new folders are always created inside it, and folders elsewhere in Grafana are second-class — checks assigned to them via Terraform or the API show up with an orange "Outside default folder" warning badge, can't be selected in the picker, don't appear in the folder filter, and can't be targeted from the UI.

This splits a team's resources across two trees (their team folder and the SM subtree), diverges from the platform's folder direction (Team Folders / unified resource folders), and means the UI and the API disagree about where checks are allowed to live.

Solution

Checks and SM folders can now live in any folder the user can edit. The default folder remains the default home for checks — nothing changes for tenants that don't touch the new options — but users can now:

• Create folders inside the default folder (still preselected), inside any other editable folder, or at the Grafana root level (with org-level folder-creation rights).
• Move an existing folder to the root or any other editable folder from the check list.
• Assign checks to any editable folder, so checks placed in arbitrary folders via Terraform/API are now first-class instead of display-only.

Folder selection everywhere (check form, bulk move, create-folder modal, move-folder modal) now uses Grafana's standard FolderPicker from @grafana/runtime instead of our custom dropdown, which gives us search, lazy tree expansion, and server-side permission filtering (only folders the user can edit are offered) — the same experience as the dashboard save dialog.

In the check list, folders outside the default subtree render as first-class groups when they contain checks (empty ones are never shown), nest under their parent when it's also visible, carry a neutral "Root" tag when top-level, and appear in the folder filter.

Notes

• This is additive: no migration, no data moved, no feature flag. Tenants that never use the new options see the same folder view as today.
• Frontend only — the check payload already passes folderUid through, and the effective-permission model (min of SM role and folder permission) already works for any folder.
• The PIR action item about validating against "external" folder assignment in the API becomes moot: UI and API now agree.
• Visual design (the "Root" tag, whether the default folder gets a visible group header) is pending UX review.

Screenshots

Testing

• Unit and integration coverage added/updated: FolderSelector, check list outside-folder rendering and nesting, folder filter, move-folder and bulk-move flows (the runtime FolderPicker is mocked in jest against the MSW folders API).
• Manually testable on a real stack with Graft by swapping in a local yarn build of this branch. One pass worth doing there: a viewer with a folder-level edit grant, to confirm the picker's server-side permission filtering end to end.