[AppConfig] Fragment search REST v2 API (admin + scoped)

[jopemachine]

Objective

Expose the app_config_fragment search surface as REST v2, split out of the fragment write PR (BA-6921, #12928) to keep each PR review-sized. Two variants: system-wide admin search (superadmin) and principal-scoped search (auth).

Background

BEP-1052. Stacks on BA-6921 (fragment write CRUD) and reuses its AppConfigFragmentNode DTO. The scoped search is the REST surface of the visible-fragments query (BA-6810, #12706).

Scope

• Filter / order / scope DTOs (AppConfigFragmentFilter, AppConfigFragmentOrder, SearchAppConfigFragmentInput, AppConfigFragmentScope, ScopedSearchAppConfigFragmentInput) + types (order field, scope-type filter)
• adapter admin_search / scoped_search + filter/order converters
• REST routes: POST /search (superadmin), POST /scoped-search (auth)

Acceptance Criteria

• /search superadmin-only (system-wide); /scoped-search auth-required (principal-visible)
• Both reflected in the OpenAPI dump; pants check / lint pass
• Verified against the live server (admin + non-admin)

Related

• Split from BA-6921 (feat(BA-6921): AppConfig fragment write REST v2 API (CRUD) #12928). BEP-1052. Scoped search backs BA-6810 (feat(BA-6810): AppConfigFragment visible-fragments query (repository layer) #12706).

JIRA Issue: BA-6922