feat: per-user inference routes with ownership scoping

Allow non-admin users to set their own inference routes. Routes are
stored with owner-scoped names (inference.local/<subject-hash>) so
each user gets isolated config while admin-created global routes
serve as fallbacks.

Changes:
- Relax set_cluster_inference role from admin to user
- Scope route names by owner for non-admin callers
- Stamp ownership label on new routes
- Verify provider ownership before referencing in a route
- Verify route ownership before updating
- Resolve per-user routes first, fall back to global
- Sandbox bundle resolution looks up sandbox owner

Closes: rossoctl/rossoctl#1995

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori