fix: the admin requests list names who asked, not a cut-off user id (#6265)

/admin/requests showed "by user f7e1ec86" — the first eight characters of
the requester's id, a placeholder from the first build. The admin list now
sends each requester's username, looked up for the whole page in one query,
and the row reads "by <username>". The id stays as the fallback for a list
that comes back without names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/admin_requests_test.go

@@ -90,6 +90,9 @@ func TestHandleListAdminRequests_DefaultStatus_Pending(t *testing.T) {
 		if rv.Status != "pending" {
 			t.Errorf("result status = %q, want pending", rv.Status)
 		}
+		if rv.Username != "alice" {
+			t.Errorf("result username = %q, want alice (the requester)", rv.Username)
+		}
 	}
 }