feat: add security group membership with workload assignment, sg: prefix resolution in policy rules, and searchable select component

Add SecurityGroupMember model with security_group_id/workload_id foreign keys and unique constraint, implement security_group_members table with timestamps, add SecurityGroupMemberCreate/SecurityGroupMemberRead schemas with workload_name/workload_external_id fields, implement workload_provider_targets helper to expand sg: prefix into multiple workload targets with

backend/app/models/domain.py

@@ -231,6 +231,17 @@ class SecurityGroup(Base, TimestampMixin):
     description: Mapped[str | None] = mapped_column(Text)
 
 
+class SecurityGroupMember(Base, TimestampMixin):
+    __tablename__ = "security_group_members"
+    __table_args__ = (UniqueConstraint("security_group_id", "workload_id"),)
+
+    id: Mapped[str] = mapped_column(String, primary_key=True, default=new_id)
+    security_group_id: Mapped[str] = mapped_column(ForeignKey("security_groups.id"), index=True)
+    workload_id: Mapped[str] = mapped_column(ForeignKey("workloads.id"), index=True)
+    security_group: Mapped[SecurityGroup] = relationship()
+    workload: Mapped[Workload] = relationship()
+
+
 class SecurityRule(Base, TimestampMixin):
     __tablename__ = "security_rules"