Add Flow Schedules API

What does this MR do and why?

This MR is part 4 of 7 in a stacked series for scheduled flow triggers (work item). The goal of the series: users will be able to run AI flows on a cron schedule.

This MR adds the GraphQL CRUD API for flow schedules:

• Three mutations: aiFlowScheduleCreate, aiFlowScheduleUpdate, aiFlowScheduleDelete.
• Two GraphQL types: AiFlowScheduleType and AiFlowScheduleLastRun.

All new GraphQL parts are marked as experiments.

It also adds the backing services:

• Create, update, and destroy services for schedules.

Other changes:

• Three new project permissions: create_ai_flow_schedule, update_ai_flow_schedule, and delete_ai_flow_schedule. They are granted to anyone who can manage flow triggers (maintainers and up).
• Granular token (fine-grained PAT) authorization for the new GraphQL surface.
• A new feature flag ai_flow_schedules (type gitlab_com_derisk, disabled by default). The flag gates the create service.
• Full spec coverage: mutation request specs, type specs, service specs, policy specs, and JSON schema specs.

There are no database migrations. The ai_flow_schedules table and the model already exist from earlier MRs in the stack.

Note on the stack: the stack was reordered to move the auth/identity work to the end, because the auth approach is still under discussion. This branch was rebased onto the reworked parent MR !250809 (merged). Review can start now as a stacked review. Merging waits until the parent MR merges.

Feature Flag rollout issue

• #627751

Related Stacked MRs (in order)

1. Adds ai_flow_schedules table for scheduled AI f... (!250227 - merged)
2. Add scheduled event type to AI flow triggers (!250805 - merged)
3. Adds Flow Schedule Model (!250809 - merged)
4. Add Flow Schedules API (!250821 - merged) (This MR)
5. Adds Flow Schedule Email Notifications (!250824 - merged)
6. Adds flow schedule execution (!250838)
7. Adds FE changes for Flow Schedules (!250843)

How to set up and validate locally

1. Enable the feature flag in the Rails console:

   Feature.enable(:ai_flow_schedules)

2. Create a flow trigger with a scheduled event type, or use the seed rake task:

   bundle exec rake db:seed_fu FILTER=ai_flow_schedules

3. Run this GraphQL mutation in GraphiQL (http://gdk.test:3000/-/graphql-explorer). Replace the trigger ID with a real one:

   mutation {
     aiFlowScheduleCreate(input: {
       flowTriggerId: "gid://gitlab/Ai::FlowTrigger/1",
       description: "Nightly run",
       cron: "0 21 * * *",
       cronTimezone: "UTC"
     }) {
       aiFlowSchedule { id cron nextRunAt }
       errors
     }
   }

4. Check the schedule in the Rails console. Ai::FlowSchedule.last should return the new schedule, and next_run_at should be set.

5. Run the specs:

   bundle exec rspec ee/spec/services/ai/flow_schedules ee/spec/requests/api/graphql/mutations/ai/flow_schedules

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.