fix: enhance service instance read endpoints to include additional fields and collection support

### E.1 Read endpoints

- `GET /service-instances/{service_instance_id}` — current SRM view of one instance;

  returns `service_instance_id`, `state`, `metadata`, optional `resource_summary` (opaque

  summary object; not a persistence column); tenant-scoped; RFC 7807 on 404.

  returns `service_instance_id`, `service_specification_id`, `state`, `app_provider_id`,

  `zone_id`, `ref`, `metadata`, optional `resource_summary` (opaque summary object; not a

  persistence column), and `capability_instances` (list of `capability_instance_id`, `kind`,

  `external_ref`, `result_summary`) — all direct projections of existing `service_instance` /

  `capability_instance` columns (Persistence §B.3), no derived fields; tenant-scoped; RFC 7807

  on 404.

  Because `appInstanceId == service_instance_id` (ADR-0005), OEG uses this endpoint directly to

  serve `GET /appinstances?appInstanceId=...` (ADR-0007 collection query reads) and to resolve

  the target of `DELETE /appinstances/{appInstanceId}` before publishing

  resolve the target of `DELETE /appinstances/{appInstanceId}` before publishing

  `command.srm.service.terminate` — no separate by-`external_ref` lookup is needed.

- `GET /service-instances` — collection form of the above, filterable by `app_provider_id`

  (always, from auth context), and optionally `service_specification_id` and `zone_id`; same

  response shape as the single-instance form, as a list. OEG uses this to serve

  `GET /appinstances?appId=...&appInstanceId=...&region=...` (ADR-0007 collection query reads),

  translating CAMARA `appId`/`appInstanceId`/`region` to `service_specification_id`/

  `service_instance_id`/`zone_id` at the mapper boundary; `ref` is surfaced to CAMARA as `name`

  (same rename pattern as elsewhere in this contract — no new SRM-side mechanism).

- `GET /operations/by-operation-id/{operation_id}` — latest `service_order` row +

  derived inventory state; read-only; tenant-scoped; RFC 7807 on 404.